Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payment Advice.exe

Overview

General Information

Sample name:Payment Advice.exe
Analysis ID:1528908
MD5:959ff310cff226f065ec9692dd5b0852
SHA1:7273bf0d8bcb9bf94fd5ad26d3973dcd6cf2b7bd
SHA256:76d1094922df386d7078ab5c8b81fbff3644afd31aaceee935b60a85866b0162
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • Payment Advice.exe (PID: 7608 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: 959FF310CFF226F065EC9692DD5B0852)
    • svchost.exe (PID: 4604 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: B7C999040D80E5BF87886D70D992C51E)
      • RAVCpl64.exe (PID: 6284 cmdline: "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s MD5: 731FB4B2E5AFBCADAABB80D642E056AC)
        • wextract.exe (PID: 5756 cmdline: "C:\Windows\SysWOW64\wextract.exe" MD5: B9CC7E24DB7DE2E75678761B1D8BAC3E)
          • explorer.exe (PID: 5064 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bb50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13c3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bb50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13c3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2df33:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16022:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2ed33:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x16e22:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 7608, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 4604, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 7608, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 4604, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: Payment Advice.exeVirustotal: Detection: 27%Perma Link
            Source: Payment Advice.exeReversingLabs: Detection: 28%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Machine Learning detection for sample
            Source: Payment Advice.exeJoe Sandbox ML: detected
            Source: Payment Advice.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: wextract.pdb source: svchost.exe, 00000002.00000003.71870710058.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71871216830.000000000323C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wextract.pdbGCTL source: svchost.exe, 00000002.00000003.71870710058.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71871216830.000000000323C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Payment Advice.exe, 00000000.00000003.71525843604.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000003.71527256863.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71818688030.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71821569465.0000000003600000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.0000000004690000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71902519209.0000000004322000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71905407512.00000000044DE000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.00000000047BD000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Payment Advice.exe, 00000000.00000003.71525843604.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000003.71527256863.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.71818688030.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71821569465.0000000003600000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.0000000004690000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71902519209.0000000004322000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71905407512.00000000044DE000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.00000000047BD000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: RAVCpl64.exe, 00000003.00000002.76603324600.000000000494C000.00000004.80000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73448050918.0000000004CBC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73446715535.0000000000775000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76615354295.000000001414C000.00000004.00000001.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: RAVCpl64.exe, 00000003.00000002.76603324600.000000000494C000.00000004.80000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73448050918.0000000004CBC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73446715535.0000000000775000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76615354295.000000001414C000.00000004.00000001.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BD1F FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindClose,0_2_0044BD1F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00475FE5
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then mov ebx, 00000004h2_2_045A04DE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: explorer.exe, 00000005.00000003.74150410272.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76608165483.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382747463.000000000DE94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
            Source: explorer.exe, 00000005.00000003.74150410272.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76608165483.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382747463.000000000DE94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
            Source: explorer.exe, 00000005.00000003.74150410272.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76608165483.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382747463.000000000DE94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009D67000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009D67000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009D67000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlipY7
            Source: explorer.exe, 00000005.00000000.73379124445.000000000AE40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.76596876834.0000000003800000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.76603892105.000000000A360000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
            Source: explorer.exe, 00000005.00000002.76601606406.0000000009DEB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377572267.0000000009E6B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/odirm
            Source: explorer.exe, 00000005.00000000.73378013198.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74149306061.000000000A018000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
            Source: explorer.exe, 00000005.00000000.73378013198.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74149306061.000000000A018000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/h
            Source: explorer.exe, 00000005.00000002.76601606406.0000000009C70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/sports/blended?market=en-us&satoriid=912df6f3-e6f5-4400-ad10-c
            Source: explorer.exe, 00000005.00000000.73381683797.000000000DE6B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76600120068.0000000005ABB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73374290015.0000000003839000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&oc
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
            Source: explorer.exe, 00000005.00000000.73376202518.0000000005ABB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76600120068.0000000005ABB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
            Source: explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/earnings/svg/light/blue.svg
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pn
            Source: explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.sv
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.svg
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Most
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/WeatherInsight/W
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm-dark
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI-dark
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
            Source: explorer.exe, 00000005.00000002.76609689900.000000000DEFC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382891771.000000000DEFC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comP
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA179X84.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1g7bhz.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1lLvot.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1nsFzx.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAUhLdx.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAY97Jf.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAaeOki.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1d0ujS.img
            Source: explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=a7af015c-55f5-465b-b0e4-6fef
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
            Source: explorer.exe, 00000005.00000000.73385616150.0000000011710000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76613192431.0000000011710000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com;
            Source: explorer.exe, 00000005.00000000.73383273995.000000000E050000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76610169841.000000000E050000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comppS
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.glamour.com/story/shag-haircut-photos-products
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.instyle.com/hair/shag-haircut-face-shape
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/autos/other/24-used-sports-cars-that-are-notoriously-reliable-yet-crazy-ch
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/entertainment/news/james-earl-jones-dies-at-93-all-about-his-son-flynn/ar-
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/feed
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-farmers-the-best-way-to-cook-zucchini-they-
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/health/medical/2-egg-brands-have-been-recalled-due-to-a-serious-salmonella
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/beauty/40-shag-haircuts-to-inspire-your-next-salon-visit/ss-AA1p
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets?id=a33k6h
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets?id=a3oxnm
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets?id=a6qja2
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/18-everyday-household-items-that-are-surprisingly-va
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/retirement/a-youtuber-asked-a-group-of-americans-aged-70-to-80-what-
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/retirement/middle-aged-americans-are-leaving-work-for-months-years-t
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRD
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-b
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/chris-christie-former-trump-debate-coach-offers-key-pieces-o
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-haitian-immigrants/ar-
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voi
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgende
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/gaza-authorities-say-deadly-blasts-hit-humanitarian-zone/ar-AA1
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/nba/johnny-gaudreau-s-wife-reveals-in-eulogy-she-s-pregnant-expecti
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/nfl/49ers-win-over-jets-ends-with-final-score-that-s-never-been-see
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/travel/news/scientists-finally-solve-mystery-behind-bermuda-triangle-disap
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-da
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/forecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xhcmEiL
            Source: explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/hourlyforecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2x
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,0_2_00456354
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047C08E SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: Payment Advice.exe
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047C08E SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,0_2_0047C08E
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004331D9 ClientToScreen,NtdllDialogWndProc_W,0_2_004331D9
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047E1FA NtdllDialogWndProc_W,0_2_0047E1FA
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0043323E NtdllDialogWndProc_W,0_2_0043323E
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046F2B0 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,0_2_0046F2B0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046F50B NtdllDialogWndProc_W,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,0_2_0046F50B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045058D GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_0045058D
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00469681 PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,0_2_00469681
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046F749 NtdllDialogWndProc_W,0_2_0046F749
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00447870 GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx,0_2_00447870
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044782B NtdllDialogWndProc_W,0_2_0044782B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044096A NtdllDialogWndProc_W,0_2_0044096A
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044796B GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W,0_2_0044796B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00440938 NtdllDialogWndProc_W,0_2_00440938
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00469995 NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_00469995
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044099C NtdllDialogWndProc_W,0_2_0044099C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00440ADF NtdllDialogWndProc_W,0_2_00440ADF
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00447A87 SendMessageW,NtdllDialogWndProc_W,0_2_00447A87
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00447B15 NtdllDialogWndProc_W,0_2_00447B15
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00440B39 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,0_2_00440B39
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00454C69 NtdllDialogWndProc_W,0_2_00454C69
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00454C1B NtdllDialogWndProc_W,0_2_00454C1B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00461EB0 NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_00461EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C003 NtClose,2_2_0042C003
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038734E0 NtCreateMutant,LdrInitializeThunk,2_2_038734E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BC0 NtQueryInformationToken,LdrInitializeThunk,2_2_03872BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872A80 NtClose,LdrInitializeThunk,2_2_03872A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EB0 NtProtectVirtualMemory,LdrInitializeThunk,2_2_03872EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D10 NtQuerySystemInformation,LdrInitializeThunk,2_2_03872D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874260 NtSetContextThread,2_2_03874260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874570 NtSuspendThread,2_2_03874570
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B80 NtCreateKey,2_2_03872B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B90 NtFreeVirtualMemory,2_2_03872B90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BE0 NtQueryVirtualMemory,2_2_03872BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B00 NtQueryValueKey,2_2_03872B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B10 NtAllocateVirtualMemory,2_2_03872B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B20 NtQueryInformationProcess,2_2_03872B20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AA0 NtQueryInformationFile,2_2_03872AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AC0 NtEnumerateValueKey,2_2_03872AC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872A10 NtWriteFile,2_2_03872A10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038729D0 NtWaitForSingleObject,2_2_038729D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038729F0 NtReadFile,2_2_038729F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038738D0 NtGetContextThread,2_2_038738D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FB0 NtSetValueKey,2_2_03872FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F00 NtCreateFile,2_2_03872F00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F30 NtOpenDirectoryObject,2_2_03872F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E80 NtCreateProcessEx,2_2_03872E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EC0 NtQuerySection,2_2_03872EC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872ED0 NtResumeThread,2_2_03872ED0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E00 NtQueueApcThread,2_2_03872E00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E50 NtCreateSection,2_2_03872E50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DA0 NtReadVirtualMemory,2_2_03872DA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DC0 NtAdjustPrivilegesToken,2_2_03872DC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D50 NtWriteVirtualMemory,2_2_03872D50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873C90 NtOpenThread,2_2_03873C90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CD0 NtEnumerateKey,2_2_03872CD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CF0 NtDelayExecution,2_2_03872CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C10 NtOpenProcess,2_2_03872C10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C20 NtSetInformationFile,2_2_03872C20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C30 NtMapViewOfSection,2_2_03872C30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873C30 NtOpenProcessToken,2_2_03873C30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C50 NtUnmapViewOfSection,2_2_03872C50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045B3619 NtSetContextThread,2_2_045B3619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045B3C5A NtResumeThread,2_2_045B3C5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045B393C NtSuspendThread,2_2_045B393C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00434D50: GetFullPathNameW,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004461ED DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,746A5590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,0_2_004461ED
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_044F36580_2_044F3658
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417FA32_2_00417FA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004010002_2_00401000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040F8132_2_0040F813
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004029C02_2_004029C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004019DA2_2_004019DA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011E02_2_004011E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004019E02_2_004019E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041618E2_2_0041618E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004161932_2_00416193
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004022162_2_00402216
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004022202_2_00402220
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FA332_2_0040FA33
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DAAB2_2_0040DAAB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DAB32_2_0040DAB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004023D02_2_004023D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040DBFB2_2_0040DBFB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402CC02_2_00402CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042E6232_2_0042E623
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402F702_2_00402F70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038313802_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3102_2_0384E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF3302_2_038FF330
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D2EC2_2_0382D2EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F124C2_2_038F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038451C02_2_038451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E02_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F1132_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390010E2_2_0390010E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD1302_2_038DD130
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0388717A2_2_0388717A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038300A02_2_038300A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384B0D02_2_0384B0D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F70F12_2_038F70F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EE0762_2_038EE076
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F67572_2_038F6757
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038427602_2_03842760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384A7602_2_0384A760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038406802_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA6C02_2_038FA6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C6E02_2_0383C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B36EC2_2_038B36EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF6F62_2_038FF6F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385C6002_2_0385C600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD62C2_2_038DD62C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ED6462_2_038ED646
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038646702_2_03864670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF5C92_2_038FF5C9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F75C62_2_038F75C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390A5262_2_0390A526
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038404452_2_03840445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4BC02_2_038B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840B102_2_03840B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFB2E2_2_038FFB2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFA892_2_038FFA89
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FAA02_2_0385FAA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FCA132_2_038FCA13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEA5B2_2_038FEA5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383E9A02_2_0383E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FE9A62_2_038FE9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038859C02_2_038859C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038568822_2_03856882
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B98B22_2_038B98B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038428C02_2_038428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F18DA2_2_038F18DA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F78F32_2_038F78F3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038438002_2_03843800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E8102_2_0386E810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E08352_2_038E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038268682_2_03826868
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038498702_2_03849870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B8702_2_0385B870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF8722_2_038FF872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEFBF2_2_038FEFBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F1FC62_2_038F1FC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03846FE02_2_03846FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384CF002_2_0384CF00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFF632_2_038FFF63
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F0EAD2_2_038F0EAD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03841EB22_2_03841EB2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F9ED22_2_038F9ED2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832EE82_2_03832EE8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860E502_2_03860E50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0E6D2_2_038E0E6D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852DB02_2_03852DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03849DD02_2_03849DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DFDF42_2_038DFDF4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383AD002_2_0383AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFD272_2_038FFD27
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F7D4C2_2_038F7D4C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840D692_2_03840D69
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D9C982_2_038D9C98
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03858CDF2_2_03858CDF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FCE02_2_0385FCE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390ACEB2_2_0390ACEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830C122_2_03830C12
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EEC4C2_2_038EEC4C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843C602_2_03843C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F6C692_2_038F6C69
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEC602_2_038FEC60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045B54142_2_045B5414
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045AE4832_2_045AE483
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045AE3682_2_045AE368
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045AE81C2_2_045AE81C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045AD8882_2_045AD888
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045ACB132_2_045ACB13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BEF10 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875050 appears 36 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887BE4 appears 88 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B910 appears 266 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AE692 appears 79 times
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: String function: 0040E6D0 appears 35 times
            Source: Payment Advice.exe, 00000000.00000003.71527256863.0000000004BE3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment Advice.exe
            Source: Payment Advice.exe, 00000000.00000003.71524139618.0000000004D8D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment Advice.exe
            Source: Payment Advice.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Payment Advice.exeStatic PE information: Section: UPX1 ZLIB complexity 0.9933401031783681
            Source: classification engineClassification label: mal100.troj.evad.winEXE@5/1@0/0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0043614F FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\Payment Advice.exeFile created: C:\Users\user\AppData\Local\Temp\cuniliJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Payment Advice.exeVirustotal: Detection: 27%
            Source: Payment Advice.exeReversingLabs: Detection: 28%
            Source: C:\Users\user\Desktop\Payment Advice.exeFile read: C:\Users\user\Desktop\Payment Advice.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
            Source: C:\Users\user\Desktop\Payment Advice.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment Advice.exe"
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"
            Source: C:\Users\user\Desktop\Payment Advice.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment Advice.exe"Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: Binary string: wextract.pdb source: svchost.exe, 00000002.00000003.71870710058.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71871216830.000000000323C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wextract.pdbGCTL source: svchost.exe, 00000002.00000003.71870710058.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71871216830.000000000323C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Payment Advice.exe, 00000000.00000003.71525843604.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000003.71527256863.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71818688030.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71821569465.0000000003600000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.0000000004690000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71902519209.0000000004322000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71905407512.00000000044DE000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.00000000047BD000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Payment Advice.exe, 00000000.00000003.71525843604.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000003.71527256863.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.71818688030.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.71903405720.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.71821569465.0000000003600000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.0000000004690000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71902519209.0000000004322000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000003.71905407512.00000000044DE000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 00000004.00000002.73447307347.00000000047BD000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: RAVCpl64.exe, 00000003.00000002.76603324600.000000000494C000.00000004.80000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73448050918.0000000004CBC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73446715535.0000000000775000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76615354295.000000001414C000.00000004.00000001.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: RAVCpl64.exe, 00000003.00000002.76603324600.000000000494C000.00000004.80000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73448050918.0000000004CBC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 00000004.00000002.73446715535.0000000000775000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76615354295.000000001414C000.00000004.00000001.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004550C9 push ebp; retf 0_2_004550CA
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_044F3849 push ebp; iretd 0_2_044F384D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004031E0 push eax; ret 2_2_004031E2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A2B1 push ds; ret 2_2_0041A2D2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004083A5 push 00000072h; ret 2_2_00408433
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00415413 push 10CBE7A4h; retf 2_2_004154F3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00401EF2 push edi; retf 2_2_00401EF3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038308CD push ecx; mov dword ptr [esp], ecx2_2_038308D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A7486 push ebp; iretd 2_2_045A7495
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A44BC push eax; retf 2_2_045A44BE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A50F9 push cs; ret 2_2_045A5107
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045B5252 push eax; ret 2_2_045B5254
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A52A6 push esp; retf 2_2_045A52A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A9FBC push eax; ret 2_2_045A9FC7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045A58FA push ebx; ret 2_2_045A5912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_045AA9CA push edx; iretd 2_2_045AA9D4
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\Payment Advice.exeAPI/Special instruction interceptor: Address: 44F327C
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D144
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB10594
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB0FF74
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D6C4
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D864
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D004
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D144
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB10594
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D764
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D324
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D364
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D004
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0FF74
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D6C4
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFCCBB0D864
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 rdtsc 2_2_03871763
            Source: C:\Windows\SysWOW64\wextract.exeWindow / User API: threadDelayed 9852Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 882Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 873Jump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeAPI coverage: 3.2 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.9 %
            Source: C:\Windows\SysWOW64\wextract.exe TID: 6772Thread sleep count: 122 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exe TID: 6772Thread sleep time: -244000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exe TID: 6772Thread sleep count: 9852 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exe TID: 6772Thread sleep time: -19704000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\wextract.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BD1F FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindClose,0_2_0044BD1F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00475FE5
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74150410272.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76608165483.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76608165483.000000000DBCF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74150410272.000000000DBCF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382747463.000000000DE94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73381683797.000000000DBCF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: wextract.exe, 00000004.00000002.73446715535.0000000000775000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 rdtsc 2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417143 LdrLoadDll,2_2_00417143
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_044F34E8 mov eax, dword ptr fs:[00000030h]0_2_044F34E8
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_044F3548 mov eax, dword ptr fs:[00000030h]0_2_044F3548
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_044F1EB8 mov eax, dword ptr fs:[00000030h]0_2_044F1EB8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831380 mov eax, dword ptr fs:[00000030h]2_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831380 mov eax, dword ptr fs:[00000030h]2_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831380 mov eax, dword ptr fs:[00000030h]2_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831380 mov eax, dword ptr fs:[00000030h]2_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831380 mov eax, dword ptr fs:[00000030h]2_2_03831380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F380 mov eax, dword ptr fs:[00000030h]2_2_0384F380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF38A mov eax, dword ptr fs:[00000030h]2_2_038EF38A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A390 mov eax, dword ptr fs:[00000030h]2_2_0385A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A390 mov eax, dword ptr fs:[00000030h]2_2_0385A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A390 mov eax, dword ptr fs:[00000030h]2_2_0385A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038393A6 mov eax, dword ptr fs:[00000030h]2_2_038393A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038393A6 mov eax, dword ptr fs:[00000030h]2_2_038393A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AC3B0 mov eax, dword ptr fs:[00000030h]2_2_038AC3B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E3C0 mov eax, dword ptr fs:[00000030h]2_2_0382E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E3C0 mov eax, dword ptr fs:[00000030h]2_2_0382E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E3C0 mov eax, dword ptr fs:[00000030h]2_2_0382E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C3C7 mov eax, dword ptr fs:[00000030h]2_2_0382C3C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038363CB mov eax, dword ptr fs:[00000030h]2_2_038363CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038633D0 mov eax, dword ptr fs:[00000030h]2_2_038633D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038643D0 mov ecx, dword ptr fs:[00000030h]2_2_038643D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B43D5 mov eax, dword ptr fs:[00000030h]2_2_038B43D5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03829303 mov eax, dword ptr fs:[00000030h]2_2_03829303
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03829303 mov eax, dword ptr fs:[00000030h]2_2_03829303
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF30A mov eax, dword ptr fs:[00000030h]2_2_038EF30A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B330C mov eax, dword ptr fs:[00000030h]2_2_038B330C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B330C mov eax, dword ptr fs:[00000030h]2_2_038B330C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B330C mov eax, dword ptr fs:[00000030h]2_2_038B330C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B330C mov eax, dword ptr fs:[00000030h]2_2_038B330C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E310 mov eax, dword ptr fs:[00000030h]2_2_0384E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E310 mov eax, dword ptr fs:[00000030h]2_2_0384E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E310 mov eax, dword ptr fs:[00000030h]2_2_0384E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386631F mov eax, dword ptr fs:[00000030h]2_2_0386631F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868322 mov eax, dword ptr fs:[00000030h]2_2_03868322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868322 mov eax, dword ptr fs:[00000030h]2_2_03868322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868322 mov eax, dword ptr fs:[00000030h]2_2_03868322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03903336 mov eax, dword ptr fs:[00000030h]2_2_03903336
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385332D mov eax, dword ptr fs:[00000030h]2_2_0385332D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E328 mov eax, dword ptr fs:[00000030h]2_2_0382E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E328 mov eax, dword ptr fs:[00000030h]2_2_0382E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E328 mov eax, dword ptr fs:[00000030h]2_2_0382E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828347 mov eax, dword ptr fs:[00000030h]2_2_03828347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828347 mov eax, dword ptr fs:[00000030h]2_2_03828347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828347 mov eax, dword ptr fs:[00000030h]2_2_03828347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A350 mov eax, dword ptr fs:[00000030h]2_2_0386A350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B360 mov eax, dword ptr fs:[00000030h]2_2_0383B360
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E363 mov eax, dword ptr fs:[00000030h]2_2_0386E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE372 mov eax, dword ptr fs:[00000030h]2_2_038AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE372 mov eax, dword ptr fs:[00000030h]2_2_038AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE372 mov eax, dword ptr fs:[00000030h]2_2_038AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE372 mov eax, dword ptr fs:[00000030h]2_2_038AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0371 mov eax, dword ptr fs:[00000030h]2_2_038B0371
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0371 mov eax, dword ptr fs:[00000030h]2_2_038B0371
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385237A mov eax, dword ptr fs:[00000030h]2_2_0385237A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE289 mov eax, dword ptr fs:[00000030h]2_2_038AE289
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03837290 mov eax, dword ptr fs:[00000030h]2_2_03837290
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03837290 mov eax, dword ptr fs:[00000030h]2_2_03837290
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03837290 mov eax, dword ptr fs:[00000030h]2_2_03837290
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF2AE mov eax, dword ptr fs:[00000030h]2_2_038EF2AE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F92AB mov eax, dword ptr fs:[00000030h]2_2_038F92AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038542AF mov eax, dword ptr fs:[00000030h]2_2_038542AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038542AF mov eax, dword ptr fs:[00000030h]2_2_038542AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B2BC mov eax, dword ptr fs:[00000030h]2_2_0390B2BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B2BC mov eax, dword ptr fs:[00000030h]2_2_0390B2BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B2BC mov eax, dword ptr fs:[00000030h]2_2_0390B2BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B2BC mov eax, dword ptr fs:[00000030h]2_2_0390B2BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038292AF mov eax, dword ptr fs:[00000030h]2_2_038292AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C2B0 mov ecx, dword ptr fs:[00000030h]2_2_0382C2B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038532C5 mov eax, dword ptr fs:[00000030h]2_2_038532C5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038632C0 mov eax, dword ptr fs:[00000030h]2_2_038632C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038632C0 mov eax, dword ptr fs:[00000030h]2_2_038632C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039032C9 mov eax, dword ptr fs:[00000030h]2_2_039032C9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038272E0 mov eax, dword ptr fs:[00000030h]2_2_038272E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2E0 mov eax, dword ptr fs:[00000030h]2_2_0383A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038382E0 mov eax, dword ptr fs:[00000030h]2_2_038382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038382E0 mov eax, dword ptr fs:[00000030h]2_2_038382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038382E0 mov eax, dword ptr fs:[00000030h]2_2_038382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038382E0 mov eax, dword ptr fs:[00000030h]2_2_038382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D2EC mov eax, dword ptr fs:[00000030h]2_2_0382D2EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D2EC mov eax, dword ptr fs:[00000030h]2_2_0382D2EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402F9 mov eax, dword ptr fs:[00000030h]2_2_038402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A200 mov eax, dword ptr fs:[00000030h]2_2_0382A200
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382821B mov eax, dword ptr fs:[00000030h]2_2_0382821B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BB214 mov eax, dword ptr fs:[00000030h]2_2_038BB214
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BB214 mov eax, dword ptr fs:[00000030h]2_2_038BB214
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0227 mov eax, dword ptr fs:[00000030h]2_2_038B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0227 mov eax, dword ptr fs:[00000030h]2_2_038B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0227 mov eax, dword ptr fs:[00000030h]2_2_038B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A22B mov eax, dword ptr fs:[00000030h]2_2_0386A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A22B mov eax, dword ptr fs:[00000030h]2_2_0386A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A22B mov eax, dword ptr fs:[00000030h]2_2_0386A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850230 mov ecx, dword ptr fs:[00000030h]2_2_03850230
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F124C mov eax, dword ptr fs:[00000030h]2_2_038F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F124C mov eax, dword ptr fs:[00000030h]2_2_038F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F124C mov eax, dword ptr fs:[00000030h]2_2_038F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F124C mov eax, dword ptr fs:[00000030h]2_2_038F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF247 mov eax, dword ptr fs:[00000030h]2_2_038EF247
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385F24A mov eax, dword ptr fs:[00000030h]2_2_0385F24A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B273 mov eax, dword ptr fs:[00000030h]2_2_0382B273
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B273 mov eax, dword ptr fs:[00000030h]2_2_0382B273
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B273 mov eax, dword ptr fs:[00000030h]2_2_0382B273
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C327E mov eax, dword ptr fs:[00000030h]2_2_038C327E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ED270 mov eax, dword ptr fs:[00000030h]2_2_038ED270
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834180 mov eax, dword ptr fs:[00000030h]2_2_03834180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834180 mov eax, dword ptr fs:[00000030h]2_2_03834180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834180 mov eax, dword ptr fs:[00000030h]2_2_03834180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03859194 mov eax, dword ptr fs:[00000030h]2_2_03859194
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871190 mov eax, dword ptr fs:[00000030h]2_2_03871190
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871190 mov eax, dword ptr fs:[00000030h]2_2_03871190
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E1A4 mov eax, dword ptr fs:[00000030h]2_2_0386E1A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E1A4 mov eax, dword ptr fs:[00000030h]2_2_0386E1A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039051B6 mov eax, dword ptr fs:[00000030h]2_2_039051B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038631BE mov eax, dword ptr fs:[00000030h]2_2_038631BE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038631BE mov eax, dword ptr fs:[00000030h]2_2_038631BE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038641BB mov ecx, dword ptr fs:[00000030h]2_2_038641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038641BB mov eax, dword ptr fs:[00000030h]2_2_038641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038641BB mov eax, dword ptr fs:[00000030h]2_2_038641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038401C0 mov eax, dword ptr fs:[00000030h]2_2_038401C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038401C0 mov eax, dword ptr fs:[00000030h]2_2_038401C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038451C0 mov eax, dword ptr fs:[00000030h]2_2_038451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038451C0 mov eax, dword ptr fs:[00000030h]2_2_038451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038451C0 mov eax, dword ptr fs:[00000030h]2_2_038451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038451C0 mov eax, dword ptr fs:[00000030h]2_2_038451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A1E3 mov eax, dword ptr fs:[00000030h]2_2_0383A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A1E3 mov eax, dword ptr fs:[00000030h]2_2_0383A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A1E3 mov eax, dword ptr fs:[00000030h]2_2_0383A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A1E3 mov eax, dword ptr fs:[00000030h]2_2_0383A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A1E3 mov eax, dword ptr fs:[00000030h]2_2_0383A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F81EE mov eax, dword ptr fs:[00000030h]2_2_038F81EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F81EE mov eax, dword ptr fs:[00000030h]2_2_038F81EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B1E0 mov eax, dword ptr fs:[00000030h]2_2_0385B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038391E5 mov eax, dword ptr fs:[00000030h]2_2_038391E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038391E5 mov eax, dword ptr fs:[00000030h]2_2_038391E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038281EB mov eax, dword ptr fs:[00000030h]2_2_038281EB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038291F0 mov eax, dword ptr fs:[00000030h]2_2_038291F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038291F0 mov eax, dword ptr fs:[00000030h]2_2_038291F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038401F1 mov eax, dword ptr fs:[00000030h]2_2_038401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038401F1 mov eax, dword ptr fs:[00000030h]2_2_038401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038401F1 mov eax, dword ptr fs:[00000030h]2_2_038401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385F1F0 mov eax, dword ptr fs:[00000030h]2_2_0385F1F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385F1F0 mov eax, dword ptr fs:[00000030h]2_2_0385F1F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385510F mov eax, dword ptr fs:[00000030h]2_2_0385510F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383510D mov eax, dword ptr fs:[00000030h]2_2_0383510D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F113 mov eax, dword ptr fs:[00000030h]2_2_0382F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860118 mov eax, dword ptr fs:[00000030h]2_2_03860118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03867128 mov eax, dword ptr fs:[00000030h]2_2_03867128
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03867128 mov eax, dword ptr fs:[00000030h]2_2_03867128
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF13E mov eax, dword ptr fs:[00000030h]2_2_038EF13E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BA130 mov eax, dword ptr fs:[00000030h]2_2_038BA130
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A147 mov eax, dword ptr fs:[00000030h]2_2_0382A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A147 mov eax, dword ptr fs:[00000030h]2_2_0382A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A147 mov eax, dword ptr fs:[00000030h]2_2_0382A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C314A mov eax, dword ptr fs:[00000030h]2_2_038C314A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C314A mov eax, dword ptr fs:[00000030h]2_2_038C314A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C314A mov eax, dword ptr fs:[00000030h]2_2_038C314A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C314A mov eax, dword ptr fs:[00000030h]2_2_038C314A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03903157 mov eax, dword ptr fs:[00000030h]2_2_03903157
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03903157 mov eax, dword ptr fs:[00000030h]2_2_03903157
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03903157 mov eax, dword ptr fs:[00000030h]2_2_03903157
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03905149 mov eax, dword ptr fs:[00000030h]2_2_03905149
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386415F mov eax, dword ptr fs:[00000030h]2_2_0386415F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386716D mov eax, dword ptr fs:[00000030h]2_2_0386716D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0388717A mov eax, dword ptr fs:[00000030h]2_2_0388717A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0388717A mov eax, dword ptr fs:[00000030h]2_2_0388717A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836179 mov eax, dword ptr fs:[00000030h]2_2_03836179
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904080 mov eax, dword ptr fs:[00000030h]2_2_03904080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A093 mov ecx, dword ptr fs:[00000030h]2_2_0382A093
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C090 mov eax, dword ptr fs:[00000030h]2_2_0382C090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EB0AF mov eax, dword ptr fs:[00000030h]2_2_038EB0AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038700A5 mov eax, dword ptr fs:[00000030h]2_2_038700A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039050B7 mov eax, dword ptr fs:[00000030h]2_2_039050B7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF0A5 mov eax, dword ptr fs:[00000030h]2_2_038DF0A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384B0D0 mov eax, dword ptr fs:[00000030h]2_2_0384B0D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B0D6 mov eax, dword ptr fs:[00000030h]2_2_0382B0D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B0D6 mov eax, dword ptr fs:[00000030h]2_2_0382B0D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B0D6 mov eax, dword ptr fs:[00000030h]2_2_0382B0D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B0D6 mov eax, dword ptr fs:[00000030h]2_2_0382B0D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C0F6 mov eax, dword ptr fs:[00000030h]2_2_0382C0F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386D0F0 mov eax, dword ptr fs:[00000030h]2_2_0386D0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386D0F0 mov ecx, dword ptr fs:[00000030h]2_2_0386D0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038290F8 mov eax, dword ptr fs:[00000030h]2_2_038290F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038290F8 mov eax, dword ptr fs:[00000030h]2_2_038290F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038290F8 mov eax, dword ptr fs:[00000030h]2_2_038290F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038290F8 mov eax, dword ptr fs:[00000030h]2_2_038290F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03855004 mov eax, dword ptr fs:[00000030h]2_2_03855004
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03855004 mov ecx, dword ptr fs:[00000030h]2_2_03855004
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838009 mov eax, dword ptr fs:[00000030h]2_2_03838009
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872010 mov ecx, dword ptr fs:[00000030h]2_2_03872010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D02D mov eax, dword ptr fs:[00000030h]2_2_0382D02D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860044 mov eax, dword ptr fs:[00000030h]2_2_03860044
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390505B mov eax, dword ptr fs:[00000030h]2_2_0390505B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831051 mov eax, dword ptr fs:[00000030h]2_2_03831051
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03831051 mov eax, dword ptr fs:[00000030h]2_2_03831051
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D9060 mov eax, dword ptr fs:[00000030h]2_2_038D9060
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03837072 mov eax, dword ptr fs:[00000030h]2_2_03837072
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836074 mov eax, dword ptr fs:[00000030h]2_2_03836074
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836074 mov eax, dword ptr fs:[00000030h]2_2_03836074
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03861796 mov eax, dword ptr fs:[00000030h]2_2_03861796
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03861796 mov eax, dword ptr fs:[00000030h]2_2_03861796
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B781 mov eax, dword ptr fs:[00000030h]2_2_0390B781
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B781 mov eax, dword ptr fs:[00000030h]2_2_0390B781
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE79D mov eax, dword ptr fs:[00000030h]2_2_038AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038307A7 mov eax, dword ptr fs:[00000030h]2_2_038307A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FD7A7 mov eax, dword ptr fs:[00000030h]2_2_038FD7A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FD7A7 mov eax, dword ptr fs:[00000030h]2_2_038FD7A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FD7A7 mov eax, dword ptr fs:[00000030h]2_2_038FD7A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039017BC mov eax, dword ptr fs:[00000030h]2_2_039017BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF7CF mov eax, dword ptr fs:[00000030h]2_2_038EF7CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E7E0 mov eax, dword ptr fs:[00000030h]2_2_0385E7E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038337E4 mov eax, dword ptr fs:[00000030h]2_2_038337E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038377F9 mov eax, dword ptr fs:[00000030h]2_2_038377F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038377F9 mov eax, dword ptr fs:[00000030h]2_2_038377F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383D700 mov ecx, dword ptr fs:[00000030h]2_2_0383D700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F970B mov eax, dword ptr fs:[00000030h]2_2_038F970B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F970B mov eax, dword ptr fs:[00000030h]2_2_038F970B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B705 mov eax, dword ptr fs:[00000030h]2_2_0382B705
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B705 mov eax, dword ptr fs:[00000030h]2_2_0382B705
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B705 mov eax, dword ptr fs:[00000030h]2_2_0382B705
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B705 mov eax, dword ptr fs:[00000030h]2_2_0382B705
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385270D mov eax, dword ptr fs:[00000030h]2_2_0385270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385270D mov eax, dword ptr fs:[00000030h]2_2_0385270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385270D mov eax, dword ptr fs:[00000030h]2_2_0385270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383471B mov eax, dword ptr fs:[00000030h]2_2_0383471B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383471B mov eax, dword ptr fs:[00000030h]2_2_0383471B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF717 mov eax, dword ptr fs:[00000030h]2_2_038EF717
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03859723 mov eax, dword ptr fs:[00000030h]2_2_03859723
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03863740 mov eax, dword ptr fs:[00000030h]2_2_03863740
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386174A mov eax, dword ptr fs:[00000030h]2_2_0386174A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov eax, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov eax, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov eax, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov ecx, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov eax, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852755 mov eax, dword ptr fs:[00000030h]2_2_03852755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A750 mov eax, dword ptr fs:[00000030h]2_2_0386A750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F75B mov eax, dword ptr fs:[00000030h]2_2_0382F75B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE750 mov eax, dword ptr fs:[00000030h]2_2_038DE750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03842760 mov ecx, dword ptr fs:[00000030h]2_2_03842760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03871763 mov eax, dword ptr fs:[00000030h]2_2_03871763
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860774 mov eax, dword ptr fs:[00000030h]2_2_03860774
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834779 mov eax, dword ptr fs:[00000030h]2_2_03834779
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834779 mov eax, dword ptr fs:[00000030h]2_2_03834779
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF68C mov eax, dword ptr fs:[00000030h]2_2_038EF68C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840680 mov eax, dword ptr fs:[00000030h]2_2_03840680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838690 mov eax, dword ptr fs:[00000030h]2_2_03838690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC691 mov eax, dword ptr fs:[00000030h]2_2_038BC691
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F86A8 mov eax, dword ptr fs:[00000030h]2_2_038F86A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F86A8 mov eax, dword ptr fs:[00000030h]2_2_038F86A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038306CF mov eax, dword ptr fs:[00000030h]2_2_038306CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA6C0 mov eax, dword ptr fs:[00000030h]2_2_038FA6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385D6D0 mov eax, dword ptr fs:[00000030h]2_2_0385D6D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038296E0 mov eax, dword ptr fs:[00000030h]2_2_038296E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038296E0 mov eax, dword ptr fs:[00000030h]2_2_038296E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C6E0 mov eax, dword ptr fs:[00000030h]2_2_0383C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038356E0 mov eax, dword ptr fs:[00000030h]2_2_038356E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038356E0 mov eax, dword ptr fs:[00000030h]2_2_038356E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038356E0 mov eax, dword ptr fs:[00000030h]2_2_038356E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038566E0 mov eax, dword ptr fs:[00000030h]2_2_038566E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038566E0 mov eax, dword ptr fs:[00000030h]2_2_038566E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AC6F2 mov eax, dword ptr fs:[00000030h]2_2_038AC6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AC6F2 mov eax, dword ptr fs:[00000030h]2_2_038AC6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C3608 mov eax, dword ptr fs:[00000030h]2_2_038C3608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385D600 mov eax, dword ptr fs:[00000030h]2_2_0385D600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385D600 mov eax, dword ptr fs:[00000030h]2_2_0385D600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF607 mov eax, dword ptr fs:[00000030h]2_2_038EF607
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386360F mov eax, dword ptr fs:[00000030h]2_2_0386360F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904600 mov eax, dword ptr fs:[00000030h]2_2_03904600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03837623 mov eax, dword ptr fs:[00000030h]2_2_03837623
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD62C mov ecx, dword ptr fs:[00000030h]2_2_038DD62C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD62C mov ecx, dword ptr fs:[00000030h]2_2_038DD62C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD62C mov eax, dword ptr fs:[00000030h]2_2_038DD62C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03835622 mov eax, dword ptr fs:[00000030h]2_2_03835622
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03835622 mov eax, dword ptr fs:[00000030h]2_2_03835622
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C620 mov eax, dword ptr fs:[00000030h]2_2_0386C620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830630 mov eax, dword ptr fs:[00000030h]2_2_03830630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860630 mov eax, dword ptr fs:[00000030h]2_2_03860630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8633 mov esi, dword ptr fs:[00000030h]2_2_038B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8633 mov eax, dword ptr fs:[00000030h]2_2_038B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8633 mov eax, dword ptr fs:[00000030h]2_2_038B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386F63F mov eax, dword ptr fs:[00000030h]2_2_0386F63F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386F63F mov eax, dword ptr fs:[00000030h]2_2_0386F63F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03833640 mov eax, dword ptr fs:[00000030h]2_2_03833640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F640 mov eax, dword ptr fs:[00000030h]2_2_0384F640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F640 mov eax, dword ptr fs:[00000030h]2_2_0384F640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384F640 mov eax, dword ptr fs:[00000030h]2_2_0384F640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C640 mov eax, dword ptr fs:[00000030h]2_2_0386C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C640 mov eax, dword ptr fs:[00000030h]2_2_0386C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D64A mov eax, dword ptr fs:[00000030h]2_2_0382D64A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D64A mov eax, dword ptr fs:[00000030h]2_2_0382D64A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03865654 mov eax, dword ptr fs:[00000030h]2_2_03865654
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383965A mov eax, dword ptr fs:[00000030h]2_2_0383965A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383965A mov eax, dword ptr fs:[00000030h]2_2_0383965A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386265C mov eax, dword ptr fs:[00000030h]2_2_0386265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386265C mov ecx, dword ptr fs:[00000030h]2_2_0386265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386265C mov eax, dword ptr fs:[00000030h]2_2_0386265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03827662 mov eax, dword ptr fs:[00000030h]2_2_03827662
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03827662 mov eax, dword ptr fs:[00000030h]2_2_03827662
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03827662 mov eax, dword ptr fs:[00000030h]2_2_03827662
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843660 mov eax, dword ptr fs:[00000030h]2_2_03843660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843660 mov eax, dword ptr fs:[00000030h]2_2_03843660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843660 mov eax, dword ptr fs:[00000030h]2_2_03843660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386666D mov esi, dword ptr fs:[00000030h]2_2_0386666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386666D mov eax, dword ptr fs:[00000030h]2_2_0386666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386666D mov eax, dword ptr fs:[00000030h]2_2_0386666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830670 mov eax, dword ptr fs:[00000030h]2_2_03830670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872670 mov eax, dword ptr fs:[00000030h]2_2_03872670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872670 mov eax, dword ptr fs:[00000030h]2_2_03872670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE588 mov eax, dword ptr fs:[00000030h]2_2_038AE588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE588 mov eax, dword ptr fs:[00000030h]2_2_038AE588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03869580 mov eax, dword ptr fs:[00000030h]2_2_03869580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03869580 mov eax, dword ptr fs:[00000030h]2_2_03869580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A580 mov eax, dword ptr fs:[00000030h]2_2_0386A580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A580 mov eax, dword ptr fs:[00000030h]2_2_0386A580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF582 mov eax, dword ptr fs:[00000030h]2_2_038EF582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03862594 mov eax, dword ptr fs:[00000030h]2_2_03862594
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC592 mov eax, dword ptr fs:[00000030h]2_2_038BC592
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B85AA mov eax, dword ptr fs:[00000030h]2_2_038B85AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038345B0 mov eax, dword ptr fs:[00000030h]2_2_038345B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038345B0 mov eax, dword ptr fs:[00000030h]2_2_038345B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C5C6 mov eax, dword ptr fs:[00000030h]2_2_0386C5C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F5C7 mov eax, dword ptr fs:[00000030h]2_2_0382F5C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05C6 mov eax, dword ptr fs:[00000030h]2_2_038B05C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038665D0 mov eax, dword ptr fs:[00000030h]2_2_038665D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5E7 mov ebx, dword ptr fs:[00000030h]2_2_0386A5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5E7 mov eax, dword ptr fs:[00000030h]2_2_0386A5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383B5E0 mov eax, dword ptr fs:[00000030h]2_2_0383B5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038615EF mov eax, dword ptr fs:[00000030h]2_2_038615EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC5FC mov eax, dword ptr fs:[00000030h]2_2_038BC5FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382B502 mov eax, dword ptr fs:[00000030h]2_2_0382B502
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E507 mov eax, dword ptr fs:[00000030h]2_2_0385E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832500 mov eax, dword ptr fs:[00000030h]2_2_03832500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C50D mov eax, dword ptr fs:[00000030h]2_2_0386C50D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C50D mov eax, dword ptr fs:[00000030h]2_2_0386C50D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03851514 mov eax, dword ptr fs:[00000030h]2_2_03851514
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC51D mov eax, dword ptr fs:[00000030h]2_2_038BC51D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov ecx, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov ecx, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DF51B mov eax, dword ptr fs:[00000030h]2_2_038DF51B
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00426DA1 CreateFileW,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,0_2_00426DA1
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004230F5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00417D93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtProtectVirtualMemory: Direct from: 0x7FFCCBAC2651Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtDelayExecution: Direct from: 0x4535A62Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtProtectVirtualMemory: Direct from: 0x453D7BFJump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtResumeThread: Direct from: 0x4535CA8Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtClose: Direct from: 0x7FFC97F09E7F
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\Payment Advice.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\wextract.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 6284Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeThread register set: target process: 6284Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\Payment Advice.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2EE7008Jump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00436431 mouse_event,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\Payment Advice.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment Advice.exe"Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: RAVCpl64.exe, 00000003.00000000.71836667546.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000002.76597037141.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.73373612765.0000000001970000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: Payment Advice.exe, RAVCpl64.exe, 00000003.00000000.71836667546.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000002.76597037141.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.73375745212.0000000005060000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: explorer.exe, 00000005.00000002.76595282087.0000000001220000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73373030322.0000000001220000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman"
            Source: RAVCpl64.exe, 00000003.00000000.71836667546.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000002.76597037141.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.73373612765.0000000001970000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: Payment Advice.exe, 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: RAVCpl64.exe, 00000003.00000000.71836667546.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000003.00000002.76597037141.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.73373612765.0000000001970000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0042039F GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_0042039F
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Payment Advice.exe, 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: Payment Advice.exeBinary or memory string: WIN_XP
            Source: Payment Advice.exeBinary or memory string: WIN_XPe
            Source: Payment Advice.exeBinary or memory string: WIN_VISTA
            Source: Payment Advice.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\Payment Advice.exeCode function: 0_2_0047AD92 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		21
            Input Capture            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		1
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory1
            Account Discovery            		Remote Desktop Protocol21
            Input Capture            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares3
            Clipboard Data            		SteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		31
            Obfuscated Files or Information            		NTDS115
            System Information Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		11
            Software Packing            		LSA Secrets241
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		1
            DLL Side-Loading            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Valid Accounts            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
            Virtualization/Sandbox Evasion            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
            Access Token Manipulation            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron412
            Process Injection            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Payment Advice.exe28%VirustotalBrowse
            Payment Advice.exe29%ReversingLabsWin32.Trojan.Generic
            Payment Advice.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW0%VirustotalBrowse
            https://api.msn.com/v1/news/Feed/Windows?0%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI0%VirustotalBrowse
            https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pn0%VirustotalBrowse
            https://api.msn.com:443/v1/news/Feed/Windows?0%VirustotalBrowse
            https://www.msn.com/en-us/money/markets?id=a3oxnm1%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI-dark0%VirustotalBrowse
            https://www.msn.com/en-us/feed0%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark0%VirustotalBrowse
            https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In0%VirustotalBrowse
            https://excel.office.com0%VirustotalBrowse
            https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq1%VirustotalBrowse
            https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png0%VirustotalBrowse
            https://aka.ms/odirm0%VirustotalBrowse
            https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew0%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi30%VirustotalBrowse
            https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.sv0%VirustotalBrowse
            https://api.msn.com/h0%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark0%VirustotalBrowse
            https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew0%VirustotalBrowse
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm0%VirustotalBrowse
            https://www.msn.com/en-us/money/markets?id=a33k6h1%VirustotalBrowse
            https://www.msn.com/en-us/money/markets?id=a6qja21%VirustotalBrowse
            https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Most0%VirustotalBrowse

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpfalseunknown
            https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pnexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowIexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
            https://www.msn.com/en-us/news/politics/chris-christie-former-trump-debate-coach-offers-key-pieces-oexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
              		unknown
              https://www.msn.com/en-us/sports/nfl/49ers-win-over-jets-ends-with-final-score-that-s-never-been-seeexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voiexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                  		unknown
                  https://www.msn.com/en-us/money/retirement/a-youtuber-asked-a-group-of-americans-aged-70-to-80-what-explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                    		unknown
                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvWexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                    https://www.msn.com/en-us/money/markets?id=a3oxnmexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                    https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                    https://www.msn.com/en-us/feedexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                    https://www.msn.com/en-us/autos/other/24-used-sports-cars-that-are-notoriously-reliable-yet-crazy-chexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown
                      https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-farmers-the-best-way-to-cook-zucchini-they-explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                        		unknown
                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI-darkexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-darkexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.pngexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        https://excel.office.comexplorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_Inexplorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiqexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                        http://schemas.microexplorer.exe, 00000005.00000000.73379124445.000000000AE40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.76596876834.0000000003800000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.76603892105.000000000A360000.00000002.00000001.00040000.00000000.sdmpfalse
                          		unknown
                          https://www.msn.com/en-us/weather/hourlyforecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                            		unknown
                            https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRDexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                              		unknown
                              https://aka.ms/odirmexplorer.exe, 00000005.00000002.76601606406.0000000009DEB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377572267.0000000009E6B000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                              https://api.msn.com/hexplorer.exe, 00000005.00000000.73378013198.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74149306061.000000000A018000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                              https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNewexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                              https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=a7af015c-55f5-465b-b0e4-6fefexplorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                		unknown
                                https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgendeexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://www.msn.com/en-us/money/retirement/middle-aged-americans-are-leaving-work-for-months-years-texplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.svexplorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://www.msn.com/en-us/money/markets?id=a33k6hexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Mostexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-darkexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwmexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNewexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                    https://www.msn.com/en-us/weather/forecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xhcmEiLexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://www.msn.com/en-us/money/markets?id=a6qja2explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalseunknown
                                      https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-daexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://word.office.comppSexplorer.exe, 00000005.00000000.73383273995.000000000E050000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76610169841.000000000E050000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/earnings/svg/light/blue.svgexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-haitian-immigrants/ar-explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://api.msn.com/sports/blended?market=en-us&satoriid=912df6f3-e6f5-4400-ad10-cexplorer.exe, 00000005.00000002.76601606406.0000000009C70000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://www.msn.com/en-us/money/personalfinance/18-everyday-household-items-that-are-surprisingly-vaexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.svgexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://powerpoint.office.comexplorer.exe, 00000005.00000000.73385616150.0000000011710000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76613192431.0000000011710000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm-darkexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://outlook.comexplorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://www.glamour.com/story/shag-haircut-photos-productsexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trumexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://www.msn.com/en-us/entertainment/news/james-earl-jones-dies-at-93-all-about-his-son-flynn/ar-explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-bexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://www.msn.com/en-us/lifestyle/beauty/40-shag-haircuts-to-inspire-your-next-salon-visit/ss-AA1pexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://www.msn.com/en-us/health/medical/2-egg-brands-have-been-recalled-due-to-a-serious-salmonellaexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/WeatherInsight/Wexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://excel.office.comPexplorer.exe, 00000005.00000002.76609689900.000000000DEFC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73382891771.000000000DEFC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://word.office.com;explorer.exe, 00000005.00000000.73380807640.000000000D91B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76607173071.000000000D91B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://www.instyle.com/hair/shag-haircut-face-shapeexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://api.msn.com/explorer.exe, 00000005.00000000.73378013198.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.000000000A018000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.74149306061.000000000A018000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&ocexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/travel/news/scientists-finally-solve-mystery-behind-bermuda-triangle-disapexplorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://www.msn.com/en-us/news/world/gaza-authorities-say-deadly-blasts-hit-humanitarian-zone/ar-AA1explorer.exe, 00000005.00000003.74152073022.0000000009CE2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.76601606406.0000000009CD2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.73377144801.0000000009CE5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown

                                                                                      World Map of Contacted IPs

                                                                                      ⊘No contacted IP infos

                                                                                      General Information

                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                      Analysis ID:1528908
                                                                                      Start date and time:2024-10-08 12:58:14 +02:00
                                                                                      Joe Sandbox product:CloudBasic
                                                                                      Overall analysis duration:0h 16m 15s
                                                                                      Hypervisor based Inspection enabled:false
                                                                                      Report type:full
                                                                                      Cookbook file name:default.jbs
                                                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                      Run name:Suspected Instruction Hammering
                                                                                      Number of analysed new started processes analysed:4
                                                                                      Number of new started drivers analysed:0
                                                                                      Number of existing processes analysed:0
                                                                                      Number of existing drivers analysed:0
                                                                                      Number of injected processes analysed:2
                                                                                      Technologies:
                                                                                      • HCA enabled
                                                                                      • EGA enabled
                                                                                      • AMSI enabled
                                                                                      Analysis Mode:default
                                                                                      Analysis stop reason:Timeout
                                                                                      Sample name:Payment Advice.exe
                                                                                      Detection:MAL
                                                                                      Classification:mal100.troj.evad.winEXE@5/1@0/0
                                                                                      EGA Information:
                                                                                      • Successful, ratio: 66.7%
                                                                                      HCA Information:
                                                                                      • Successful, ratio: 95%
                                                                                      • Number of executed functions: 34
                                                                                      • Number of non-executed functions: 311
                                                                                      Cookbook Comments:
                                                                                      • Found application associated with file extension: .exe
                                                                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                      Warnings

                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe
                                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                      • Report size getting too big, too many NtOpenKey calls found.
                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                      Simulations

                                                                                      Behavior and APIs

                                                                                      TimeTypeDescription
                                                                                      07:01:38API Interceptor11252927x Sleep call for process: wextract.exe modified
                                                                                      07:07:50API Interceptor42x Sleep call for process: explorer.exe modified

                                                                                      Joe Sandbox View / Context

                                                                                      IPs

                                                                                      ⊘No context

                                                                                      Domains

                                                                                      ⊘No context

                                                                                      ASNs

                                                                                      ⊘No context

                                                                                      JA3 Fingerprints

                                                                                      ⊘No context

                                                                                      Dropped Files

                                                                                      ⊘No context

                                                                                      Created / dropped Files

                                                                                      C:\Users\user\AppData\Local\Temp\cunili

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Payment Advice.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):286208
                                                                                      Entropy (8bit):7.996177108668472
                                                                                      Encrypted:true
                                                                                      SSDEEP:6144:nHGPqTpM+yeqYonQpVi6Vu61LwAyyv3C86/8uhxU2Q2f4e5wqXZRfyvqW:UqTpM+ykTiylBwAy03C86/8uDUa4GwqG
                                                                                      MD5:D2412AF5FE8B3BE3643C7E172E88B4B0
                                                                                      SHA1:B5FA99D7EAA4020F5F98D9CF1F9D974F6189328B
                                                                                      SHA-256:36705BF1BBB90E0B303D7FCEFEFE60956CF411FA0B263784BCFD78FDA706D1A5
                                                                                      SHA-512:FD954B5069D69360CDD4B8F32DB4A321F051335F83EA5213A40436D5E053F481444B1A5A7CCF0784DDA4A4DFBB96588B4ECFA6C7B6F7DDC1584609F3871EA6E7
                                                                                      Malicious:false
                                                                                      Reputation:low
                                                                                      Preview:.bs..7HE9..S..r.JQ....1>..OG7HE9PYGZUVUEN1JRWBI426P86OG7.E9PWX.[V.L...S..h`Z_#.F=(P:$Tp:&4;9!e,Tj ",i]\..weo*X, .]TM~UVUEN1J+VK..RQ..V(..(".J..o62.T..k"..(..../ ..,Z8d'=.VUEN1JRW..42zQ96..~(E9PYGZUV.EL0AS\BIx66P86OG7HE.DYGZEVUE.5JRW.I4"6P84OG1HE9PYGZSVUEN1JRW"M424P86OG7JEy.YGJUVEEN1JBWBY426P86_G7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426~LS737HE..]GZEVUE.5JRGBI426P86OG7HE9pYG:UVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P86OG7HE9PYGZUVUEN1JRWBI426P

                                                                                      Static File Info

                                                                                      General

                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                      Entropy (8bit):7.978492876656701
                                                                                      TrID:
                                                                                      • Win32 Executable (generic) a (10002005/4) 94.59%
                                                                                      • AutoIt3 compiled script executable (510682/80) 4.83%
                                                                                      • UPX compressed Win32 Executable (30571/9) 0.29%
                                                                                      • Win32 EXE Yoda's Crypter (26571/9) 0.25%
                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                      File name:Payment Advice.exe
                                                                                      File size:975'893 bytes
                                                                                      MD5:959ff310cff226f065ec9692dd5b0852
                                                                                      SHA1:7273bf0d8bcb9bf94fd5ad26d3973dcd6cf2b7bd
                                                                                      SHA256:76d1094922df386d7078ab5c8b81fbff3644afd31aaceee935b60a85866b0162
                                                                                      SHA512:58e2c11ea465d6952333b1a073edc50c126c09c81e643a13f53569b25e216b15c3101b90182f7dc07d5b5cafdf33bb5025c08f32e2cf7014aa9deb10f0ea59e1
                                                                                      SSDEEP:24576:VD0tM85tbNJjldeYiYU4eBxaYcK77b0iEvu7ZOViJnadN/eR:VD0tM85DJjl/isQxXz0iEvGiiJadA
                                                                                      TLSH:4F252303B280A86EEA9F5476E95736870607FCB11F0323CA57766BD67A70630E2B7435
                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                      File Icon

                                                                                      Icon Hash:1733312925935517

                                                                                      Static PE Info

                                                                                      General

                                                                                      Entrypoint:0x4b8b90
                                                                                      Entrypoint Section:UPX1
                                                                                      Digitally signed:false
                                                                                      Imagebase:0x400000
                                                                                      Subsystem:windows gui
                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                      DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                      Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                      TLS Callbacks:
                                                                                      CLR (.Net) Version:
                                                                                      OS Version Major:5
                                                                                      OS Version Minor:0
                                                                                      File Version Major:5
                                                                                      File Version Minor:0
                                                                                      Subsystem Version Major:5
                                                                                      Subsystem Version Minor:0
                                                                                      Import Hash:77b2e5e9b52fbef7638f64ab65f0c58c

                                                                                      Entrypoint Preview

                                                                                      Instruction
                                                                                      pushad
                                                                                      mov esi, 00477000h
                                                                                      lea edi, dword ptr [esi-00076000h]
                                                                                      push edi
                                                                                      jmp 00007FE8209ACF2Dh
                                                                                      nop
                                                                                      mov al, byte ptr [esi]
                                                                                      inc esi
                                                                                      mov byte ptr [edi], al
                                                                                      inc edi
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      jc 00007FE8209ACF0Fh
                                                                                      mov eax, 00000001h
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      adc eax, eax
                                                                                      add ebx, ebx
                                                                                      jnc 00007FE8209ACF2Dh
                                                                                      jne 00007FE8209ACF4Ah
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      jc 00007FE8209ACF41h
                                                                                      dec eax
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      adc eax, eax
                                                                                      jmp 00007FE8209ACEF6h
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      adc ecx, ecx
                                                                                      jmp 00007FE8209ACF74h
                                                                                      xor ecx, ecx
                                                                                      sub eax, 03h
                                                                                      jc 00007FE8209ACF33h
                                                                                      shl eax, 08h
                                                                                      mov al, byte ptr [esi]
                                                                                      inc esi
                                                                                      xor eax, FFFFFFFFh
                                                                                      je 00007FE8209ACF97h
                                                                                      sar eax, 1
                                                                                      mov ebp, eax
                                                                                      jmp 00007FE8209ACF2Dh
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      jc 00007FE8209ACEEEh
                                                                                      inc ecx
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      jc 00007FE8209ACEE0h
                                                                                      add ebx, ebx
                                                                                      jne 00007FE8209ACF29h
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      adc ecx, ecx
                                                                                      add ebx, ebx
                                                                                      jnc 00007FE8209ACF11h
                                                                                      jne 00007FE8209ACF2Bh
                                                                                      mov ebx, dword ptr [esi]
                                                                                      sub esi, FFFFFFFCh
                                                                                      adc ebx, ebx
                                                                                      jnc 00007FE8209ACF06h
                                                                                      add ecx, 02h
                                                                                      cmp ebp, FFFFFB00h
                                                                                      adc ecx, 02h
                                                                                      lea edx, dword ptr [edi+ebp]
                                                                                      cmp ebp, FFFFFFFCh
                                                                                      jbe 00007FE8209ACF30h
                                                                                      mov al, byte ptr [edx]

                                                                                      Rich Headers

                                                                                      Programming Language:
                                                                                      • [ASM] VS2008 SP1 build 30729
                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                      • [C++] VS2008 SP1 build 30729
                                                                                      • [ C ] VS2005 build 50727
                                                                                      • [IMP] VS2005 build 50727
                                                                                      • [ASM] VS2008 build 21022
                                                                                      • [RES] VS2008 build 21022
                                                                                      • [LNK] VS2008 SP1 build 30729

                                                                                      Data Directories

                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xc00380x3b0.rsrc
                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xb90000x7038.rsrc
                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                      Sections

                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                      UPX00x10000x760000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                      UPX10x770000x420000x41e00f914a8d655ae07ad6878d428980d492eFalse0.9933401031783681data7.929619295565276IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                      .rsrc0xb90000x80000x7400375506aad8714493f389985f5be0ee28False0.5646214978448276data5.905766661808417IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                      Resources

                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                      RT_ICON0xb95cc0x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                      RT_ICON0xb96f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                      RT_ICON0xb98240x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                      RT_ICON0xb99500x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                      RT_ICON0xb9fbc0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                      RT_ICON0xba2a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                      RT_ICON0xba3d40xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                      RT_ICON0xbb2800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                      RT_ICON0xbbb2c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                      RT_ICON0xbc0980x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                      RT_ICON0xbe6440x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                      RT_ICON0xbf6f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                      RT_MENU0xb1b280x50dataEnglishGreat Britain1.1375
                                                                                      RT_DIALOG0xb1b780xfcdataEnglishGreat Britain1.0436507936507937
                                                                                      RT_STRING0xb1c780x530dataEnglishGreat Britain1.0082831325301205
                                                                                      RT_STRING0xb21a80x690dataEnglishGreat Britain1.006547619047619
                                                                                      RT_STRING0xb28380x43adataEnglishGreat Britain1.010166358595194
                                                                                      RT_STRING0xb2c780x5fcdataEnglishGreat Britain1.0071801566579635
                                                                                      RT_STRING0xb32780x65cdataEnglishGreat Britain1.0067567567567568
                                                                                      RT_STRING0xb38d80x388dataEnglishGreat Britain1.0121681415929205
                                                                                      RT_STRING0xb3c600x158dataEnglishUnited States1.0319767441860466
                                                                                      RT_GROUP_ICON0xbfb5c0x84dataEnglishGreat Britain0.6439393939393939
                                                                                      RT_GROUP_ICON0xbfbe40x14dataEnglishGreat Britain1.15
                                                                                      RT_GROUP_ICON0xbfbfc0x14dataEnglishGreat Britain1.25
                                                                                      RT_GROUP_ICON0xbfc140x14dataEnglishGreat Britain1.25
                                                                                      RT_VERSION0xbfc2c0x19cdataEnglishGreat Britain0.5339805825242718
                                                                                      RT_MANIFEST0xbfdcc0x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                      Imports

                                                                                      DLLImport
                                                                                      KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
                                                                                      ADVAPI32.dllGetAce
                                                                                      COMCTL32.dllImageList_Remove
                                                                                      COMDLG32.dllGetSaveFileNameW
                                                                                      GDI32.dllLineTo
                                                                                      MPR.dllWNetGetConnectionW
                                                                                      ole32.dllCoInitialize
                                                                                      OLEAUT32.dllSafeArrayUnaccessData
                                                                                      PSAPI.DLLEnumProcesses
                                                                                      SHELL32.dllDragFinish
                                                                                      USER32.dllGetDC
                                                                                      USERENV.dllLoadUserProfileW
                                                                                      VERSION.dllVerQueryValueW
                                                                                      WININET.dllFtpOpenFileW
                                                                                      WINMM.dlltimeGetTime
                                                                                      WSOCK32.dllrecv

                                                                                      Possible Origin

                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                      EnglishGreat Britain
                                                                                      EnglishUnited States

                                                                                      Network Behavior

                                                                                      ⊘No network behavior found

                                                                                      Statistics

                                                                                      CPU Usage

                                                                                      Click to jump to process

                                                                                      Memory Usage

                                                                                      Click to jump to process

                                                                                      High Level Behavior Distribution

                                                                                      Click to dive into process behavior distribution

                                                                                      Behavior

                                                                                      Click to jump to process

                                                                                      System Behavior

                                                                                      General

                                                                                      Target ID:0
                                                                                      Start time:07:00:23
                                                                                      Start date:08/10/2024
                                                                                      Path:C:\Users\user\Desktop\Payment Advice.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Desktop\Payment Advice.exe"
                                                                                      Imagebase:0x400000
                                                                                      File size:975'893 bytes
                                                                                      MD5 hash:959FF310CFF226F065EC9692DD5B0852
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:2
                                                                                      Start time:07:00:25
                                                                                      Start date:08/10/2024
                                                                                      Path:C:\Windows\SysWOW64\svchost.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Desktop\Payment Advice.exe"
                                                                                      Imagebase:0xcb0000
                                                                                      File size:47'016 bytes
                                                                                      MD5 hash:B7C999040D80E5BF87886D70D992C51E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.71906788419.0000000005EB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.71902213370.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:3
                                                                                      Start time:07:00:56
                                                                                      Start date:08/10/2024
                                                                                      Path:C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
                                                                                      Imagebase:0x140000000
                                                                                      File size:16'696'840 bytes
                                                                                      MD5 hash:731FB4B2E5AFBCADAABB80D642E056AC
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:4
                                                                                      Start time:07:00:57
                                                                                      Start date:08/10/2024
                                                                                      Path:C:\Windows\SysWOW64\wextract.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Windows\SysWOW64\wextract.exe"
                                                                                      Imagebase:0xee0000
                                                                                      File size:136'192 bytes
                                                                                      MD5 hash:B9CC7E24DB7DE2E75678761B1D8BAC3E
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.73447019188.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.73447097868.00000000043E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:5
                                                                                      Start time:07:03:30
                                                                                      Start date:08/10/2024
                                                                                      Path:C:\Windows\explorer.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                                      Imagebase:0x7ff7f5020000
                                                                                      File size:4'849'904 bytes
                                                                                      MD5 hash:5EA66FF5AE5612F921BC9DA23BAC95F7
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:high
                                                                                      Has exited:false

                                                                                      Disassembly

                                                                                      Reset < >

                                                                                        Execution Graph

                                                                                        Execution Coverage:3.1%
                                                                                        Dynamic/Decrypted Code Coverage:1.1%
                                                                                        Signature Coverage:3.3%
                                                                                        Total number of Nodes:1583
                                                                                        Total number of Limit Nodes:39
                                                                                        execution_graph 85066 40f110 RegOpenKeyExW 85067 40f13c RegQueryValueExW RegCloseKey 85066->85067 85068 40f15f 85066->85068 85067->85068 85069 429212 85074 410b90 85069->85074 85072 411421 73 API calls 85073 42922f 85072->85073 85075 410b9a 85074->85075 85076 41171a 74 API calls 85075->85076 85077 410c31 GetModuleFileNameW 85076->85077 85091 413db0 85077->85091 85079 410c66 85094 413e3c 85079->85094 85082 41171a 74 API calls 85083 410ca3 85082->85083 85084 410cd1 RegOpenKeyExW 85083->85084 85085 429bc3 RegQueryValueExW 85084->85085 85086 410cf7 85084->85086 85087 429cd9 RegCloseKey 85085->85087 85088 429bf2 85085->85088 85086->85072 85089 41171a 74 API calls 85088->85089 85090 429cd8 85088->85090 85089->85088 85090->85087 85097 413b95 85091->85097 85127 41abec 85094->85127 85098 413bae 85097->85098 85099 413c2f 85097->85099 85098->85099 85112 413c1d 85098->85112 85119 41ab19 66 API calls 85098->85119 85100 413d60 85099->85100 85101 413d7b 85099->85101 85123 417f23 66 API calls 85100->85123 85125 417f23 66 API calls 85101->85125 85104 413d65 85114 413cfb 85104->85114 85124 417ebb 6 API calls 85104->85124 85107 413d03 85107->85099 85110 413d8e 85107->85110 85107->85114 85108 413cb9 85108->85099 85109 413cd6 85108->85109 85121 41ab19 66 API calls 85108->85121 85109->85099 85109->85114 85115 413cef 85109->85115 85126 41ab19 66 API calls 85110->85126 85112->85099 85118 413c9b 85112->85118 85120 41ab19 66 API calls 85112->85120 85114->85079 85122 41ab19 66 API calls 85115->85122 85118->85107 85118->85108 85119->85112 85120->85118 85121->85109 85122->85114 85123->85104 85125->85104 85126->85114 85128 41ac02 85127->85128 85129 41abfd 85127->85129 85136 417f23 66 API calls 85128->85136 85129->85128 85130 41ac22 85129->85130 85134 410c99 85130->85134 85138 417f23 66 API calls 85130->85138 85134->85082 85135 41ac07 85137 417ebb 6 API calls 85135->85137 85136->85135 85138->85135 85139 401230 85140 401241 85139->85140 85141 4012c5 85139->85141 85154 401be0 85140->85154 85143 40126b 85144 4012ae KillTimer SetTimer 85143->85144 85145 42aa61 85143->85145 85146 401298 85143->85146 85144->85141 85149 42aa8b Shell_NotifyIconW 85145->85149 85150 42aa69 Shell_NotifyIconW 85145->85150 85147 4012a2 85146->85147 85148 42aaac 85146->85148 85147->85144 85151 42aaf8 Shell_NotifyIconW 85147->85151 85152 42aad7 Shell_NotifyIconW 85148->85152 85153 42aab5 Shell_NotifyIconW 85148->85153 85149->85144 85150->85144 85151->85144 85152->85144 85153->85144 85155 401bfb 85154->85155 85156 401cde 85154->85156 85176 4013a0 74 API calls 85155->85176 85156->85143 85158 401c0b 85159 42a9a0 LoadStringW 85158->85159 85160 401c18 85158->85160 85162 42a9bb 85159->85162 85177 4021e0 85160->85177 85190 40df50 74 API calls 85162->85190 85163 401c2d 85165 401c3a 85163->85165 85166 42a9cd 85163->85166 85165->85162 85167 401c44 85165->85167 85191 40d3b0 74 API calls 85166->85191 85189 40d3b0 74 API calls 85167->85189 85170 42a9dc 85171 42a9f0 85170->85171 85173 401c53 85170->85173 85192 40d3b0 74 API calls 85171->85192 85175 401cc2 Shell_NotifyIconW 85173->85175 85174 42a9fe 85175->85156 85176->85158 85178 4021f1 85177->85178 85179 42a598 85177->85179 85182 402205 85178->85182 85183 402226 85178->85183 85195 40c740 85179->85195 85181 42a5a2 85193 404020 74 API calls 85182->85193 85194 401380 74 API calls 85183->85194 85186 40222d 85186->85181 85188 41171a 74 API calls 85186->85188 85187 40220c 85187->85163 85188->85187 85189->85173 85190->85173 85191->85170 85192->85174 85193->85187 85194->85186 85196 40c752 85195->85196 85197 40c747 85195->85197 85196->85181 85197->85196 85200 402ae0 74 API calls 85197->85200 85199 42a572 85199->85181 85200->85199 85201 4034b0 85202 4034b9 85201->85202 85203 4034bd 85201->85203 85204 42a0ba 85203->85204 85205 41171a 74 API calls 85203->85205 85206 4034fe 85205->85206 85207 416193 85244 41718c 85207->85244 85209 41619f GetStartupInfoW 85212 4161c2 85209->85212 85245 41aa31 HeapCreate 85212->85245 85213 416212 85247 416e29 GetModuleHandleW 85213->85247 85218 416223 85281 41b669 85218->85281 85220 416231 85221 41623d GetCommandLineW 85220->85221 85350 4117af 66 API calls 85220->85350 85296 42235f GetEnvironmentStringsW 85221->85296 85224 41623c 85224->85221 85225 41624c 85302 4222b1 GetModuleFileNameW 85225->85302 85227 416256 85228 416261 85227->85228 85351 4117af 66 API calls 85227->85351 85306 422082 85228->85306 85232 416272 85319 41186e 85232->85319 85235 416279 85237 416284 85235->85237 85353 4117af 66 API calls 85235->85353 85325 40d7f0 85237->85325 85240 4162b3 85355 411a4b 66 API calls 85240->85355 85243 4162b8 85244->85209 85246 416206 85245->85246 85246->85213 85348 41616a 66 API calls 85246->85348 85248 416e44 85247->85248 85249 416e3d 85247->85249 85250 416fac 85248->85250 85251 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85248->85251 85356 41177f Sleep GetModuleHandleW 85249->85356 85366 416ad5 69 API calls 85250->85366 85253 416e97 TlsAlloc 85251->85253 85257 416218 85253->85257 85258 416ee5 TlsSetValue 85253->85258 85255 416e43 85255->85248 85257->85218 85349 41616a 66 API calls 85257->85349 85258->85257 85259 416ef6 85258->85259 85357 411a69 6 API calls 85259->85357 85261 416efb 85262 41696e 6 API calls 85261->85262 85263 416f06 85262->85263 85264 41696e 6 API calls 85263->85264 85265 416f16 85264->85265 85266 41696e 6 API calls 85265->85266 85267 416f26 85266->85267 85268 41696e 6 API calls 85267->85268 85269 416f36 85268->85269 85358 41828b InitializeCriticalSectionAndSpinCount 85269->85358 85271 416f43 85271->85250 85272 4169e9 6 API calls 85271->85272 85273 416f57 85272->85273 85273->85250 85359 416ffb 85273->85359 85276 4169e9 6 API calls 85277 416f8a 85276->85277 85277->85250 85278 416f91 85277->85278 85365 416b12 66 API calls 85278->85365 85280 416f99 GetCurrentThreadId 85280->85257 85385 41718c 85281->85385 85283 41b675 GetStartupInfoA 85284 416ffb 66 API calls 85283->85284 85290 41b696 85284->85290 85285 41b8b4 85285->85220 85286 41b831 GetStdHandle 85295 41b7fb 85286->85295 85287 41b896 SetHandleCount 85287->85285 85288 416ffb 66 API calls 85288->85290 85289 41b843 GetFileType 85289->85295 85290->85285 85290->85288 85291 41b77e 85290->85291 85290->85295 85291->85285 85292 41b7a7 GetFileType 85291->85292 85291->85295 85386 4189e6 InitializeCriticalSectionAndSpinCount 85291->85386 85292->85291 85295->85285 85295->85286 85295->85287 85295->85289 85387 4189e6 InitializeCriticalSectionAndSpinCount 85295->85387 85297 422370 85296->85297 85298 422374 85296->85298 85297->85225 85299 416fb6 66 API calls 85298->85299 85300 422395 85299->85300 85301 42239c FreeEnvironmentStringsW 85300->85301 85301->85225 85303 4222e6 85302->85303 85304 416fb6 66 API calls 85303->85304 85305 422329 85303->85305 85304->85305 85305->85227 85307 42209a 85306->85307 85311 416267 85306->85311 85308 416ffb 66 API calls 85307->85308 85314 4220be 85308->85314 85309 422123 85310 413a88 66 API calls 85309->85310 85310->85311 85311->85232 85352 4117af 66 API calls 85311->85352 85312 416ffb 66 API calls 85312->85314 85313 422149 85315 413a88 66 API calls 85313->85315 85314->85309 85314->85311 85314->85312 85314->85313 85317 422108 85314->85317 85388 426349 66 API calls 85314->85388 85315->85311 85317->85314 85389 417d93 10 API calls 85317->85389 85320 41187c 85319->85320 85390 418486 85320->85390 85322 41189a 85323 411421 73 API calls 85322->85323 85324 4118b9 85322->85324 85323->85324 85324->85235 85326 431bcb 85325->85326 85327 40d80c 85325->85327 85328 4092c0 VariantClear 85327->85328 85329 40d847 85328->85329 85394 40eb50 85329->85394 85332 40d877 85397 411ac6 66 API calls 85332->85397 85335 40d888 85398 411b24 66 API calls 85335->85398 85337 40d891 85399 40f370 SystemParametersInfoW SystemParametersInfoW 85337->85399 85339 40d89f 85400 40d6d0 GetCurrentDirectoryW 85339->85400 85341 40d8a7 SystemParametersInfoW 85342 40d8d4 85341->85342 85343 40d8cd FreeLibrary 85341->85343 85344 4092c0 VariantClear 85342->85344 85343->85342 85345 40d8dd 85344->85345 85346 4092c0 VariantClear 85345->85346 85347 40d8e6 85346->85347 85347->85240 85354 411a1f 66 API calls 85347->85354 85348->85213 85349->85218 85350->85224 85351->85228 85352->85232 85353->85237 85354->85240 85355->85243 85356->85255 85357->85261 85358->85271 85361 417004 85359->85361 85362 416f70 85361->85362 85363 417022 Sleep 85361->85363 85367 422452 85361->85367 85362->85250 85362->85276 85364 417037 85363->85364 85364->85361 85364->85362 85365->85280 85366->85257 85368 42245e 85367->85368 85369 422476 85368->85369 85379 422495 85368->85379 85380 417f23 66 API calls 85369->85380 85371 42247b 85381 417ebb 6 API calls 85371->85381 85373 422507 RtlAllocateHeap 85373->85379 85374 42248b 85374->85361 85376 418407 65 API calls 85376->85379 85379->85373 85379->85374 85379->85376 85382 41a74c RtlReAllocateHeap RtlAllocateHeap VirtualAlloc HeapFree VirtualAlloc 85379->85382 85383 42254e RtlLeaveCriticalSection 85379->85383 85384 411afc 6 API calls 85379->85384 85380->85371 85382->85379 85383->85379 85384->85379 85385->85283 85386->85291 85387->85295 85388->85314 85389->85317 85392 41848c 85390->85392 85391 41696e 6 API calls 85391->85392 85392->85391 85393 4184a4 85392->85393 85393->85322 85438 40eb70 85394->85438 85397->85335 85398->85337 85399->85339 85442 401f80 85400->85442 85402 40d6f1 IsDebuggerPresent 85403 431a9d MessageBoxA 85402->85403 85404 40d6ff 85402->85404 85405 431ab6 85403->85405 85404->85405 85406 40d71f 85404->85406 85533 403e90 74 API calls 85405->85533 85512 40f3b0 85406->85512 85410 40d73a GetFullPathNameW 85530 401440 126 API calls 85410->85530 85412 40d77a 85413 40d782 85412->85413 85415 431b09 SetCurrentDirectoryW 85412->85415 85414 40d78b 85413->85414 85534 43604b 6 API calls 85413->85534 85522 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85414->85522 85415->85413 85418 431b28 85418->85414 85420 431b30 GetModuleFileNameW 85418->85420 85422 431ba4 GetForegroundWindow ShellExecuteW 85420->85422 85423 431b4c 85420->85423 85426 40d7c7 85422->85426 85535 401b70 85423->85535 85424 40d795 85432 40d7a8 85424->85432 85531 40e1e0 96 API calls 85424->85531 85429 40d7d1 SetCurrentDirectoryW 85426->85429 85429->85341 85431 431b66 85542 40d3b0 74 API calls 85431->85542 85432->85426 85532 401000 Shell_NotifyIconW 85432->85532 85435 431b72 GetForegroundWindow ShellExecuteW 85436 431b9f 85435->85436 85436->85426 85437 40eba0 LoadLibraryA GetProcAddress 85437->85332 85439 40d86e 85438->85439 85440 40eb76 LoadLibraryA 85438->85440 85439->85332 85439->85437 85440->85439 85441 40eb87 GetProcAddress 85440->85441 85441->85439 85543 40e680 74 API calls 85442->85543 85444 401f90 85544 402940 74 API calls 85444->85544 85446 401fa2 GetModuleFileNameW 85545 40ff90 85446->85545 85448 401fbd 85557 4107b0 74 API calls 85448->85557 85450 401fd6 85451 401b70 74 API calls 85450->85451 85452 401fe4 85451->85452 85558 4019e0 75 API calls 85452->85558 85454 401ff2 85455 4092c0 VariantClear 85454->85455 85456 402002 85455->85456 85457 401b70 74 API calls 85456->85457 85458 40201c 85457->85458 85559 4019e0 75 API calls 85458->85559 85460 40202c 85461 401b70 74 API calls 85460->85461 85462 40203c 85461->85462 85560 40c3e0 74 API calls 85462->85560 85464 40204d 85561 40c060 85464->85561 85468 40206e 85567 4115d0 78 API calls 85468->85567 85470 40207d 85471 42c174 85470->85471 85472 402088 85470->85472 85578 401a70 74 API calls 85471->85578 85568 4115d0 78 API calls 85472->85568 85475 42c189 85579 401a70 74 API calls 85475->85579 85476 402093 85476->85475 85477 40209e 85476->85477 85569 4115d0 78 API calls 85477->85569 85480 42c1a7 85482 42c1b0 GetModuleFileNameW 85480->85482 85481 4020a9 85481->85482 85483 4020b4 85481->85483 85580 401a70 74 API calls 85482->85580 85570 4115d0 78 API calls 85483->85570 85486 42c1e2 85581 40df50 74 API calls 85486->85581 85487 4020bf 85496 42c20a 85487->85496 85503 402107 85487->85503 85571 401a70 74 API calls 85487->85571 85489 42c1f1 85582 401a70 74 API calls 85489->85582 85490 402119 85493 42c243 85490->85493 85573 40e7e0 75 API calls 85490->85573 85494 4020e5 85572 401a70 74 API calls 85494->85572 85495 42c201 85495->85496 85583 401a70 74 API calls 85496->85583 85499 402132 85574 40d030 75 API calls 85499->85574 85502 40213e 85504 4092c0 VariantClear 85502->85504 85503->85490 85503->85496 85507 402148 85504->85507 85505 402184 85509 4092c0 VariantClear 85505->85509 85507->85505 85575 40d030 75 API calls 85507->85575 85576 40e640 75 API calls 85507->85576 85577 401a70 74 API calls 85507->85577 85511 402196 85509->85511 85511->85402 85514 40f3c9 85512->85514 85519 40d732 85514->85519 86244 40ffb0 75 API calls 85514->86244 85515 40f3d2 86245 410130 SHGetMalloc 85515->86245 85517 40f3d9 86250 410020 87 API calls 85517->86250 85519->85410 85519->85412 85520 40f3e7 86251 40f400 85520->86251 85523 42b9d3 85522->85523 85524 41025a LoadImageW RegisterClassExW 85522->85524 86301 443e8f EnumResourceNamesW LoadImageW 85523->86301 86297 4102f0 GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 85524->86297 85528 42b9da 85529 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85529->85424 85530->85412 85531->85432 85532->85426 85533->85412 85534->85418 85536 401b76 85535->85536 85537 41171a 74 API calls 85536->85537 85540 401bc5 85536->85540 85538 401bad 85537->85538 85539 41171a 74 API calls 85538->85539 85539->85540 85541 40d3b0 74 API calls 85540->85541 85541->85431 85542->85435 85543->85444 85544->85446 85584 40f5e0 85545->85584 85548 40ffa6 85548->85448 85550 42b6d8 85551 42b6e6 85550->85551 85640 434fe1 85550->85640 85552 413a88 66 API calls 85551->85552 85554 42b6f5 85552->85554 85555 434fe1 105 API calls 85554->85555 85556 42b702 85555->85556 85556->85448 85557->85450 85558->85454 85559->85460 85560->85464 85562 41171a 74 API calls 85561->85562 85563 40c088 85562->85563 85564 41171a 74 API calls 85563->85564 85565 402061 85564->85565 85566 401a70 74 API calls 85565->85566 85566->85468 85567->85470 85568->85476 85569->85481 85570->85487 85571->85494 85572->85503 85573->85499 85574->85502 85575->85507 85576->85507 85577->85507 85578->85475 85579->85480 85580->85486 85581->85489 85582->85495 85583->85507 85644 40f580 85584->85644 85586 40f5f8 85652 40f6d0 85586->85652 85592 42b2ee 85681 4151b0 85592->85681 85593 40f679 85593->85592 85594 40f681 85593->85594 85668 414e94 85594->85668 85598 40f68b 85598->85548 85603 452574 85598->85603 85600 42b31d 85687 415484 85600->85687 85602 42b33d 85604 41557c 104 API calls 85603->85604 85605 4525df 85604->85605 86189 4523ce 85605->86189 85608 4525fc 85608->85550 85609 4151b0 80 API calls 85610 45261d 85609->85610 85611 4151b0 80 API calls 85610->85611 85612 45262e 85611->85612 85613 4151b0 80 API calls 85612->85613 85614 452649 85613->85614 85615 4151b0 80 API calls 85614->85615 85616 452666 85615->85616 85617 41557c 104 API calls 85616->85617 85618 452682 85617->85618 85619 4138ba 66 API calls 85618->85619 85620 45268e 85619->85620 85621 4138ba 66 API calls 85620->85621 85622 45269b 85621->85622 85623 4151b0 80 API calls 85622->85623 85624 4526ac 85623->85624 85625 44afdc GetSystemTimeAsFileTime 85624->85625 85626 4526bf 85625->85626 85627 4526d5 85626->85627 85628 4526fd 85626->85628 85629 413a88 66 API calls 85627->85629 85630 452704 85628->85630 85631 45275b 85628->85631 85633 4526df 85629->85633 86195 44b195 85630->86195 85632 413a88 66 API calls 85631->85632 85635 452759 85632->85635 85636 413a88 66 API calls 85633->85636 85635->85550 85638 4526e8 85636->85638 85637 452753 85639 413a88 66 API calls 85637->85639 85638->85550 85639->85635 85641 434ff1 85640->85641 85642 434feb 85640->85642 85641->85551 85643 414e94 105 API calls 85642->85643 85643->85641 85645 429440 85644->85645 85646 40f589 85644->85646 85647 40f58f WideCharToMultiByte 85646->85647 85648 40f5d8 85647->85648 85649 40f5ad 85647->85649 85648->85586 85650 41171a 74 API calls 85649->85650 85651 40f5bb WideCharToMultiByte 85650->85651 85651->85586 85653 40f6dd 85652->85653 85700 40f790 85653->85700 85656 414e06 85720 414d40 85656->85720 85658 40f666 85658->85592 85659 40f450 85658->85659 85660 40f45a 85659->85660 85661 4151b0 80 API calls 85660->85661 85662 40f531 85660->85662 85664 42936d 85660->85664 85803 41557c 85660->85803 85661->85660 85662->85593 85665 41557c 104 API calls 85664->85665 85666 429394 85665->85666 85667 4151b0 80 API calls 85666->85667 85667->85662 85669 414ea0 85668->85669 85670 414ed1 85669->85670 85671 414eb4 85669->85671 85673 415965 67 API calls 85670->85673 85679 414ec9 85670->85679 85942 417f23 66 API calls 85671->85942 85675 414ee9 85673->85675 85674 414eb9 85943 417ebb 6 API calls 85674->85943 85926 414e1d 85675->85926 85679->85598 86011 41511a 85681->86011 85683 4151c8 85684 44afdc 85683->85684 86182 4431e0 85684->86182 85686 44affd 85686->85600 85688 415490 85687->85688 85689 4154bb 85688->85689 85690 41549e 85688->85690 85692 415965 67 API calls 85689->85692 86186 417f23 66 API calls 85690->86186 85694 4154c3 85692->85694 85693 4154a3 86187 417ebb 6 API calls 85693->86187 85695 4152e7 70 API calls 85694->85695 85697 4154cf 85695->85697 86188 4154e8 RtlLeaveCriticalSection RtlLeaveCriticalSection 85697->86188 85699 4154b3 85699->85602 85703 40f7ae 85700->85703 85701 42a349 85703->85701 85704 40f628 85703->85704 85705 415258 85703->85705 85704->85656 85706 415285 85705->85706 85707 415268 85705->85707 85706->85707 85709 41528c 85706->85709 85716 417f23 66 API calls 85707->85716 85718 41c551 102 API calls 85709->85718 85710 41526d 85717 417ebb 6 API calls 85710->85717 85713 4152b2 85714 41527d 85713->85714 85719 4191c9 100 API calls 85713->85719 85714->85703 85716->85710 85718->85713 85719->85714 85723 414d4c 85720->85723 85721 414d5f 85772 417f23 66 API calls 85721->85772 85723->85721 85725 414d95 85723->85725 85724 414d64 85773 417ebb 6 API calls 85724->85773 85739 41e28c 85725->85739 85728 414d74 85728->85658 85729 414d9a 85730 414da1 85729->85730 85731 414dae 85729->85731 85774 417f23 66 API calls 85730->85774 85733 414dd6 85731->85733 85734 414db6 85731->85734 85757 41dfd8 85733->85757 85775 417f23 66 API calls 85734->85775 85740 41e298 85739->85740 85741 418407 66 API calls 85740->85741 85751 41e2a6 85741->85751 85742 41e322 85744 416fb6 66 API calls 85742->85744 85746 41e32c 85744->85746 85745 41e3b0 85745->85729 85754 41e31b 85746->85754 85782 4189e6 InitializeCriticalSectionAndSpinCount 85746->85782 85748 418344 66 API calls 85748->85751 85750 41e351 85752 41e35c 85750->85752 85753 41e36f RtlEnterCriticalSection 85750->85753 85751->85742 85751->85748 85751->85754 85780 4159a6 67 API calls 85751->85780 85781 415a14 RtlLeaveCriticalSection RtlLeaveCriticalSection 85751->85781 85755 413a88 66 API calls 85752->85755 85753->85754 85777 41e3bb 85754->85777 85755->85754 85765 41dffb 85757->85765 85758 41e015 85787 417f23 66 API calls 85758->85787 85759 41e1e9 85759->85758 85763 41e247 85759->85763 85761 41e01a 85788 417ebb 6 API calls 85761->85788 85784 425db0 85763->85784 85765->85758 85765->85759 85789 4136bc 78 API calls 85765->85789 85768 41e1e2 85768->85759 85790 4136bc 78 API calls 85768->85790 85770 41e201 85770->85759 85791 4136bc 78 API calls 85770->85791 85772->85724 85774->85728 85775->85728 85776 414dfc RtlLeaveCriticalSection RtlLeaveCriticalSection 85776->85728 85783 41832d RtlLeaveCriticalSection 85777->85783 85779 41e3c2 85779->85745 85780->85751 85781->85751 85782->85750 85783->85779 85792 425ce4 85784->85792 85786 414de1 85786->85776 85787->85761 85789->85768 85790->85770 85791->85759 85793 425cf0 85792->85793 85794 425d03 85793->85794 85796 425d41 85793->85796 85795 417f23 66 API calls 85794->85795 85797 425d08 85795->85797 85798 4255c4 131 API calls 85796->85798 85799 417ebb 6 API calls 85797->85799 85800 425d5b 85798->85800 85801 425d17 85799->85801 85802 425d82 RtlLeaveCriticalSection 85800->85802 85801->85786 85802->85801 85804 415588 85803->85804 85805 415596 85804->85805 85807 4155c4 85804->85807 85834 417f23 66 API calls 85805->85834 85816 415965 85807->85816 85809 41559b 85835 417ebb 6 API calls 85809->85835 85815 4155ab 85815->85660 85817 415977 85816->85817 85818 415999 RtlEnterCriticalSection 85816->85818 85817->85818 85819 41597f 85817->85819 85821 4155cc 85818->85821 85820 418407 66 API calls 85819->85820 85820->85821 85822 4154f2 85821->85822 85823 415512 85822->85823 85824 415502 85822->85824 85828 415524 85823->85828 85837 4152e7 85823->85837 85891 417f23 66 API calls 85824->85891 85854 41486c 85828->85854 85833 415507 85836 4155f7 RtlLeaveCriticalSection RtlLeaveCriticalSection 85833->85836 85834->85809 85836->85815 85838 41531a 85837->85838 85839 4152fa 85837->85839 85840 41453a 66 API calls 85838->85840 85892 417f23 66 API calls 85839->85892 85842 415320 85840->85842 85845 41efd4 70 API calls 85842->85845 85843 4152ff 85893 417ebb 6 API calls 85843->85893 85846 415335 85845->85846 85847 4153a9 85846->85847 85849 415364 85846->85849 85853 41530f 85846->85853 85894 417f23 66 API calls 85847->85894 85850 41efd4 70 API calls 85849->85850 85849->85853 85851 415404 85850->85851 85852 41efd4 70 API calls 85851->85852 85851->85853 85852->85853 85853->85828 85855 414885 85854->85855 85859 4148a7 85854->85859 85856 41453a 66 API calls 85855->85856 85855->85859 85857 4148a0 85856->85857 85895 41c3cf 100 API calls 85857->85895 85860 41453a 85859->85860 85861 41455e 85860->85861 85862 414549 85860->85862 85866 41efd4 85861->85866 85896 417f23 66 API calls 85862->85896 85864 41454e 85897 417ebb 6 API calls 85864->85897 85867 41efe0 85866->85867 85868 41f003 85867->85868 85869 41efe8 85867->85869 85871 41f011 85868->85871 85874 41f052 85868->85874 85918 417f36 66 API calls 85869->85918 85920 417f36 66 API calls 85871->85920 85872 41efed 85919 417f23 66 API calls 85872->85919 85898 41ba3b 85874->85898 85876 41f016 85921 417f23 66 API calls 85876->85921 85879 41f058 85882 41f065 85879->85882 85883 41f07b 85879->85883 85880 41f01d 85922 417ebb 6 API calls 85880->85922 85908 41ef5f 85882->85908 85923 417f23 66 API calls 85883->85923 85884 41eff5 85884->85833 85887 41f073 85925 41f0a6 RtlLeaveCriticalSection 85887->85925 85888 41f080 85924 417f36 66 API calls 85888->85924 85891->85833 85892->85843 85894->85853 85895->85859 85896->85864 85899 41ba47 85898->85899 85900 41baa2 85899->85900 85901 418407 66 API calls 85899->85901 85902 41bac4 85900->85902 85903 41baa7 RtlEnterCriticalSection 85900->85903 85904 41ba73 85901->85904 85902->85879 85903->85902 85905 4189e6 InitializeCriticalSectionAndSpinCount 85904->85905 85907 41ba8a 85904->85907 85905->85907 85906 41bad2 RtlLeaveCriticalSection 85906->85900 85907->85906 85909 41b9c4 66 API calls 85908->85909 85910 41ef6e 85909->85910 85911 41ef84 SetFilePointer 85910->85911 85912 41ef74 85910->85912 85913 41ef9b GetLastError 85911->85913 85916 41efa3 85911->85916 85914 417f23 66 API calls 85912->85914 85913->85916 85915 41ef79 85914->85915 85915->85887 85916->85915 85917 417f49 66 API calls 85916->85917 85917->85915 85918->85872 85919->85884 85920->85876 85921->85880 85923->85888 85924->85887 85925->85884 85927 414e31 85926->85927 85928 414e4d 85926->85928 85972 417f23 66 API calls 85927->85972 85930 41486c 100 API calls 85928->85930 85935 414e46 85928->85935 85932 414e59 85930->85932 85931 414e36 85973 417ebb 6 API calls 85931->85973 85945 41e680 85932->85945 85944 414f08 RtlLeaveCriticalSection RtlLeaveCriticalSection 85935->85944 85937 41453a 66 API calls 85938 414e67 85937->85938 85949 41e5b3 85938->85949 85940 414e6d 85940->85935 85941 413a88 66 API calls 85940->85941 85941->85935 85942->85674 85944->85679 85946 41e690 85945->85946 85947 414e61 85945->85947 85946->85947 85948 413a88 66 API calls 85946->85948 85947->85937 85948->85947 85950 41e5bf 85949->85950 85951 41e5e2 85950->85951 85952 41e5c7 85950->85952 85954 41e5f0 85951->85954 85957 41e631 85951->85957 85989 417f36 66 API calls 85952->85989 85991 417f36 66 API calls 85954->85991 85955 41e5cc 85990 417f23 66 API calls 85955->85990 85960 41ba3b 67 API calls 85957->85960 85959 41e5f5 85992 417f23 66 API calls 85959->85992 85962 41e637 85960->85962 85965 41e652 85962->85965 85966 41e644 85962->85966 85963 41e5fc 85993 417ebb 6 API calls 85963->85993 85994 417f23 66 API calls 85965->85994 85974 41e517 85966->85974 85967 41e5d4 85967->85940 85970 41e64c 85995 41e676 RtlLeaveCriticalSection 85970->85995 85972->85931 85996 41b9c4 85974->85996 85976 41e57d 86009 41b93e 67 API calls 85976->86009 85978 41e527 85978->85976 85979 41e55b 85978->85979 85980 41b9c4 66 API calls 85978->85980 85979->85976 85981 41b9c4 66 API calls 85979->85981 85983 41e552 85980->85983 85984 41e567 CloseHandle 85981->85984 85982 41e585 85985 41e5a7 85982->85985 86010 417f49 66 API calls 85982->86010 85986 41b9c4 66 API calls 85983->85986 85984->85976 85987 41e573 GetLastError 85984->85987 85985->85970 85986->85979 85987->85976 85989->85955 85990->85967 85991->85959 85992->85963 85994->85970 85995->85967 85997 41b9d1 85996->85997 85998 41b9e9 85996->85998 85999 417f36 66 API calls 85997->85999 86001 417f36 66 API calls 85998->86001 86006 41ba2e 85998->86006 86000 41b9d6 85999->86000 86002 417f23 66 API calls 86000->86002 86003 41ba17 86001->86003 86004 41b9de 86002->86004 86005 417f23 66 API calls 86003->86005 86004->85978 86007 41ba1e 86005->86007 86006->85978 86008 417ebb 6 API calls 86007->86008 86008->86006 86009->85982 86010->85985 86012 415126 86011->86012 86013 41516f 86012->86013 86015 415164 86012->86015 86019 41513a 86012->86019 86014 415965 67 API calls 86013->86014 86016 415177 86014->86016 86015->85683 86024 414f10 86016->86024 86040 417f23 66 API calls 86019->86040 86020 415154 86041 417ebb 6 API calls 86020->86041 86025 414f2e 86024->86025 86030 414f4c 86024->86030 86026 414f37 86025->86026 86025->86030 86032 414f8b 86025->86032 86093 417f23 66 API calls 86026->86093 86028 414f3c 86094 417ebb 6 API calls 86028->86094 86042 4151a6 RtlLeaveCriticalSection RtlLeaveCriticalSection 86030->86042 86032->86030 86033 4150d5 86032->86033 86034 4150a9 86032->86034 86035 41453a 66 API calls 86032->86035 86043 41ed9e 86032->86043 86073 41e6b1 86032->86073 86095 41ee9b 66 API calls 86032->86095 86097 417f23 66 API calls 86033->86097 86096 417f23 66 API calls 86034->86096 86035->86032 86040->86020 86042->86015 86044 41edaa 86043->86044 86045 41edb2 86044->86045 86046 41edcd 86044->86046 86167 417f36 66 API calls 86045->86167 86048 41eddb 86046->86048 86052 41ee1c 86046->86052 86169 417f36 66 API calls 86048->86169 86049 41edb7 86168 417f23 66 API calls 86049->86168 86051 41ede0 86170 417f23 66 API calls 86051->86170 86055 41ee29 86052->86055 86056 41ee3d 86052->86056 86172 417f36 66 API calls 86055->86172 86058 41ba3b 67 API calls 86056->86058 86060 41ee43 86058->86060 86059 41ee2e 86173 417f23 66 API calls 86059->86173 86061 41ee50 86060->86061 86062 41ee66 86060->86062 86098 41e7dc 86061->86098 86174 417f23 66 API calls 86062->86174 86067 41edbf 86067->86032 86068 41ede7 86171 417ebb 6 API calls 86068->86171 86069 41ee5e 86176 41ee91 RtlLeaveCriticalSection 86069->86176 86070 41ee6b 86175 417f36 66 API calls 86070->86175 86074 41e6c1 86073->86074 86077 41e6de 86073->86077 86180 417f23 66 API calls 86074->86180 86076 41e6c6 86181 417ebb 6 API calls 86076->86181 86079 41e713 86077->86079 86085 41e6d6 86077->86085 86177 423600 86077->86177 86081 41453a 66 API calls 86079->86081 86082 41e727 86081->86082 86083 41ed9e 78 API calls 86082->86083 86084 41e72e 86083->86084 86084->86085 86086 41453a 66 API calls 86084->86086 86085->86032 86087 41e751 86086->86087 86087->86085 86088 41453a 66 API calls 86087->86088 86089 41e75d 86088->86089 86089->86085 86090 41453a 66 API calls 86089->86090 86091 41e769 86090->86091 86092 41453a 66 API calls 86091->86092 86092->86085 86093->86028 86095->86032 86096->86028 86097->86028 86099 41e813 86098->86099 86100 41e7f8 86098->86100 86102 41e822 86099->86102 86104 41e849 86099->86104 86101 417f36 66 API calls 86100->86101 86103 41e7fd 86101->86103 86105 417f36 66 API calls 86102->86105 86107 417f23 66 API calls 86103->86107 86106 41e868 86104->86106 86121 41e87c 86104->86121 86108 41e827 86105->86108 86109 417f36 66 API calls 86106->86109 86118 41e805 86107->86118 86111 417f23 66 API calls 86108->86111 86113 41e86d 86109->86113 86110 41e8d4 86112 417f36 66 API calls 86110->86112 86114 41e82e 86111->86114 86115 41e8d9 86112->86115 86116 417f23 66 API calls 86113->86116 86117 417ebb 6 API calls 86114->86117 86119 417f23 66 API calls 86115->86119 86120 41e874 86116->86120 86117->86118 86118->86069 86119->86120 86124 417ebb 6 API calls 86120->86124 86121->86110 86121->86118 86122 41e8b0 86121->86122 86123 41e8f5 86121->86123 86122->86110 86129 41e8bb ReadFile 86122->86129 86126 416fb6 66 API calls 86123->86126 86124->86118 86130 41e90b 86126->86130 86127 41ed62 GetLastError 86131 41ebe8 86127->86131 86132 41ed6f 86127->86132 86128 41e9e7 86128->86127 86135 41e9fb 86128->86135 86129->86127 86129->86128 86133 41e931 86130->86133 86134 41e913 86130->86134 86139 417f49 66 API calls 86131->86139 86147 41eb6d 86131->86147 86137 417f23 66 API calls 86132->86137 86136 423462 68 API calls 86133->86136 86138 417f23 66 API calls 86134->86138 86146 41ec2d 86135->86146 86135->86147 86148 41ea17 86135->86148 86141 41e93d 86136->86141 86142 41ed74 86137->86142 86140 41e918 86138->86140 86139->86147 86143 417f36 66 API calls 86140->86143 86141->86129 86144 417f36 66 API calls 86142->86144 86143->86118 86144->86147 86145 413a88 66 API calls 86145->86118 86146->86147 86149 41eca5 ReadFile 86146->86149 86147->86118 86147->86145 86150 41ea7d ReadFile 86148->86150 86155 41eafa 86148->86155 86152 41ecc4 GetLastError 86149->86152 86160 41ecce 86149->86160 86151 41ea9b GetLastError 86150->86151 86159 41eaa5 86150->86159 86151->86148 86151->86159 86152->86146 86152->86160 86153 41ebbe MultiByteToWideChar 86153->86147 86154 41ebe2 GetLastError 86153->86154 86154->86131 86155->86147 86156 41eb75 86155->86156 86157 41eb68 86155->86157 86164 41eb32 86155->86164 86162 41ebac 86156->86162 86156->86164 86158 417f23 66 API calls 86157->86158 86158->86147 86159->86148 86163 423462 68 API calls 86159->86163 86160->86146 86161 423462 68 API calls 86160->86161 86161->86160 86165 423462 68 API calls 86162->86165 86163->86159 86164->86153 86166 41ebbb 86165->86166 86166->86153 86167->86049 86168->86067 86169->86051 86170->86068 86172->86059 86173->86068 86174->86070 86175->86069 86176->86067 86178 416fb6 66 API calls 86177->86178 86179 423615 86178->86179 86179->86079 86180->86076 86185 414cef GetSystemTimeAsFileTime 86182->86185 86184 4431ef 86184->85686 86185->86184 86186->85693 86188->85699 86194 4523e1 86189->86194 86190 4151b0 80 API calls 86190->86194 86191 44afdc GetSystemTimeAsFileTime 86191->86194 86192 452553 86192->85608 86192->85609 86193 41557c 104 API calls 86193->86194 86194->86190 86194->86191 86194->86192 86194->86193 86196 44b1b4 86195->86196 86197 44b1a6 86195->86197 86199 414e06 137 API calls 86196->86199 86200 44b1c2 86196->86200 86201 44b1ca 86196->86201 86198 414e06 137 API calls 86197->86198 86198->86196 86202 44b2c1 86199->86202 86200->85637 86230 4352d1 80 API calls 86201->86230 86202->86201 86204 44b2cf 86202->86204 86206 44b2dc 86204->86206 86209 414e94 105 API calls 86204->86209 86205 44b20d 86207 44b211 86205->86207 86208 44b23b 86205->86208 86206->85637 86211 44b21e 86207->86211 86214 414e94 105 API calls 86207->86214 86231 43526e 86208->86231 86209->86206 86212 44b22e 86211->86212 86215 414e94 105 API calls 86211->86215 86212->85637 86213 44b242 86216 44b270 86213->86216 86217 44b248 86213->86217 86214->86211 86215->86212 86241 44b0af 110 API calls 86216->86241 86219 44b255 86217->86219 86221 414e94 105 API calls 86217->86221 86222 44b265 86219->86222 86224 414e94 105 API calls 86219->86224 86220 44b276 86242 43522c 66 API calls 86220->86242 86221->86219 86222->85637 86224->86222 86225 44b27c 86226 44b289 86225->86226 86227 414e94 105 API calls 86225->86227 86228 44b299 86226->86228 86229 414e94 105 API calls 86226->86229 86227->86226 86228->85637 86229->86228 86230->86205 86232 4138ba 66 API calls 86231->86232 86233 43527d 86232->86233 86234 4138ba 66 API calls 86233->86234 86235 43528d 86234->86235 86236 4138ba 66 API calls 86235->86236 86237 43529d 86236->86237 86239 4352bc 86237->86239 86243 43522c 66 API calls 86237->86243 86239->86213 86240 4352c8 86240->86213 86241->86220 86242->86225 86243->86240 86244->85515 86246 410148 SHGetDesktopFolder 86245->86246 86249 4101a3 86245->86249 86247 41015a 86246->86247 86246->86249 86248 41018a SHGetPathFromIDListW 86247->86248 86247->86249 86248->86249 86249->85517 86250->85520 86252 40f5e0 151 API calls 86251->86252 86253 40f417 86252->86253 86254 42ca37 86253->86254 86256 40f42c 86253->86256 86257 42ca1f 86253->86257 86255 452574 139 API calls 86254->86255 86258 42ca50 86255->86258 86292 4037e0 138 API calls 86256->86292 86293 43717f 109 API calls 86257->86293 86261 42ca76 86258->86261 86262 42ca54 86258->86262 86266 41171a 74 API calls 86261->86266 86265 434fe1 105 API calls 86262->86265 86263 40f446 86263->85519 86264 42ca2d 86264->86254 86267 42ca5e 86265->86267 86279 42cacc 86266->86279 86294 43717f 109 API calls 86267->86294 86269 42ccc3 86271 413a88 66 API calls 86269->86271 86270 42ca6c 86270->86261 86272 42cccd 86271->86272 86273 434fe1 105 API calls 86272->86273 86274 42ccda 86273->86274 86278 401b70 74 API calls 86278->86279 86279->86269 86279->86278 86282 445051 86279->86282 86285 402cc0 74 API calls 86279->86285 86286 4026a0 86279->86286 86295 44c80c 86 API calls 86279->86295 86296 44b408 74 API calls 86279->86296 86283 41171a 74 API calls 86282->86283 86284 445080 86283->86284 86284->86279 86284->86284 86285->86279 86287 4026af 86286->86287 86289 40276b 86286->86289 86288 41171a 74 API calls 86287->86288 86287->86289 86290 4026ee 86287->86290 86288->86290 86289->86279 86290->86289 86291 41171a 74 API calls 86290->86291 86291->86290 86292->86263 86293->86264 86294->86270 86295->86279 86296->86279 86298 410390 LoadIconW 86297->86298 86300 40d790 86298->86300 86300->85529 86301->85528 84809 444343 84812 444326 84809->84812 84811 44434e WriteFile 84813 444340 84812->84813 84814 4442c7 84812->84814 84813->84811 84819 40e190 SetFilePointerEx 84814->84819 84816 4442e0 SetFilePointerEx 84820 40e190 SetFilePointerEx 84816->84820 84818 4442ff 84818->84811 84819->84816 84820->84818 86302 431914 86303 431920 86302->86303 86304 431928 86303->86304 86305 43193d 86303->86305 86566 45e62e 115 API calls 86304->86566 86567 47f2b4 173 API calls 86305->86567 86308 43194a 86342 4095b0 86308->86342 86568 45e62e 115 API calls 86308->86568 86309 409708 86311 4097af 86311->86309 86553 40d590 VariantClear 86311->86553 86314 4315b8 WaitForSingleObject 86316 4315d6 GetExitCodeProcess CloseHandle 86314->86316 86314->86342 86557 40d590 VariantClear 86316->86557 86317 431623 Sleep 86320 43163b timeGetTime 86317->86320 86338 409894 86317->86338 86320->86338 86323 40986e Sleep 86325 409880 timeGetTime 86323->86325 86323->86338 86324 4098f1 TranslateMessage DispatchMessageW 86324->86342 86325->86338 86326 431673 CloseHandle 86326->86338 86327 43170c GetExitCodeProcess CloseHandle 86327->86338 86328 40d590 VariantClear 86328->86338 86330 46dd22 130 API calls 86330->86338 86332 46e641 131 API calls 86332->86338 86333 431781 Sleep 86333->86342 86338->86326 86338->86327 86338->86328 86338->86330 86338->86332 86338->86333 86338->86342 86345 4092c0 VariantClear 86338->86345 86554 447e59 74 API calls 86338->86554 86555 453b07 76 API calls 86338->86555 86556 4646a2 75 API calls 86338->86556 86558 444233 87 API calls 86338->86558 86559 457509 VariantClear 86338->86559 86560 404120 86338->86560 86564 4717e3 VariantClear 86338->86564 86565 436272 6 API calls 86338->86565 86342->86309 86342->86311 86342->86314 86342->86317 86342->86323 86342->86324 86342->86338 86343 45e62e 115 API calls 86342->86343 86344 4319c9 VariantClear 86342->86344 86346 4092c0 VariantClear 86342->86346 86348 40b380 86342->86348 86372 409340 86342->86372 86405 409030 86342->86405 86419 40d300 86342->86419 86424 40d320 86342->86424 86430 409a40 86342->86430 86569 40e380 VariantClear 86342->86569 86343->86342 86344->86342 86345->86338 86346->86342 86349 40b3a5 86348->86349 86350 40b53d 86348->86350 86351 430a99 86349->86351 86357 40b3b6 86349->86357 86570 45e62e 115 API calls 86350->86570 86571 45e62e 115 API calls 86351->86571 86354 40b528 86354->86342 86355 430aae 86359 4092c0 VariantClear 86355->86359 86357->86355 86360 40b3f2 86357->86360 86371 40b4fd 86357->86371 86358 430dc9 86358->86358 86359->86354 86361 40b429 86360->86361 86363 430ae9 VariantClear 86360->86363 86364 40b476 86360->86364 86370 40b43b 86361->86370 86572 40e380 VariantClear 86361->86572 86362 40b4eb 86362->86371 86573 40e380 VariantClear 86362->86573 86363->86370 86364->86362 86366 430d08 86364->86366 86365 430d41 VariantClear 86365->86371 86366->86365 86366->86371 86368 41171a 74 API calls 86368->86364 86370->86364 86370->86368 86371->86354 86574 45e62e 115 API calls 86371->86574 86373 409386 86372->86373 86399 409395 86372->86399 86575 4042f0 74 API calls 86373->86575 86376 42fba9 86579 45e62e 115 API calls 86376->86579 86378 42fc07 86581 45e62e 115 API calls 86378->86581 86379 42fc85 86583 4781ae 139 API calls 86379->86583 86383 42fd4f 86387 4092c0 VariantClear 86383->86387 86384 42fcd8 86585 47f2b4 173 API calls 86384->86585 86385 42fc9c 86393 409484 86385->86393 86584 45e62e 115 API calls 86385->86584 86386 42fd39 86587 45e62e 115 API calls 86386->86587 86387->86393 86390 42fce9 86390->86393 86586 45e62e 115 API calls 86390->86586 86392 40946f 86576 409210 VariantClear 86392->86576 86393->86342 86394 4094c1 86394->86393 86577 404260 75 API calls 86394->86577 86397 40947b 86400 4092c0 VariantClear 86397->86400 86399->86376 86399->86378 86399->86379 86399->86383 86399->86384 86399->86386 86399->86392 86399->86393 86399->86394 86399->86397 86402 4092c0 VariantClear 86399->86402 86578 453155 74 API calls 86399->86578 86580 40c620 117 API calls 86399->86580 86582 45e62e 115 API calls 86399->86582 86400->86393 86402->86399 86403 4094e1 86404 4092c0 VariantClear 86403->86404 86404->86393 86588 409110 116 API calls 86405->86588 86407 40906e 86408 42ceb6 86407->86408 86411 42cea9 86407->86411 86413 4090a4 86407->86413 86598 410ae0 VariantClear 86408->86598 86410 42cebf 86597 45e62e 115 API calls 86411->86597 86589 404160 86413->86589 86416 4090f0 86416->86342 86417 4092c0 VariantClear 86418 4090be 86417->86418 86418->86416 86418->86417 86421 4292e3 86419->86421 86423 40d30c 86419->86423 86420 429323 86420->86342 86421->86420 86422 4292fd TranslateAcceleratorW 86421->86422 86422->86423 86423->86342 86425 4296d0 86424->86425 86428 40d32f 86424->86428 86425->86342 86426 40d33c 86426->86342 86427 42972a IsDialogMessageW 86427->86426 86427->86428 86428->86426 86428->86427 86733 4340ec GetClassLongW 86428->86733 86431 409a66 86430->86431 86432 41171a 74 API calls 86431->86432 86493 40aade 86431->86493 86433 409a9c 86432->86433 86435 41171a 74 API calls 86433->86435 86437 409abd 86435->86437 86436 42cee9 86438 41171a 74 API calls 86436->86438 86439 409aeb CharUpperBuffW 86437->86439 86442 409b09 86437->86442 86437->86493 86480 42cf10 86438->86480 86439->86442 86483 409b88 86442->86483 86736 47d10e 149 API calls 86442->86736 86443 4092c0 VariantClear 86444 42e5e0 86443->86444 86768 410ae0 VariantClear 86444->86768 86446 42e5f2 86447 409e4a 86450 41171a 74 API calls 86447->86450 86454 409ea4 86447->86454 86447->86480 86448 40aa5b 86451 41171a 74 API calls 86448->86451 86449 41171a 74 API calls 86449->86483 86450->86454 86468 40aa81 86451->86468 86453 409ed0 86456 42d50d 86453->86456 86515 409ef8 86453->86515 86746 40b800 VariantClear VariantClear 86453->86746 86454->86453 86455 41171a 74 API calls 86454->86455 86457 42d480 86455->86457 86460 42d527 86456->86460 86747 40b800 VariantClear VariantClear 86456->86747 86459 42d491 86457->86459 86742 44b3f6 74 API calls 86457->86742 86743 40df50 74 API calls 86459->86743 86460->86515 86748 40e2e0 VariantClear 86460->86748 86461 42d195 VariantClear 86461->86483 86462 40a3a7 86466 40a415 86462->86466 86514 42db5c 86462->86514 86463 4092c0 VariantClear 86463->86483 86472 41171a 74 API calls 86466->86472 86476 41171a 74 API calls 86468->86476 86489 40a41c 86472->86489 86474 42db96 86754 45e62e 115 API calls 86474->86754 86476->86493 86477 42d4a6 86744 4530b3 74 API calls 86477->86744 86479 42d128 86482 4092c0 VariantClear 86479->86482 86767 45e62e 115 API calls 86480->86767 86481 42d4d7 86745 4530b3 74 API calls 86481->86745 86488 42d131 86482->86488 86483->86447 86483->86448 86483->86449 86483->86461 86483->86463 86483->86468 86483->86479 86483->86480 86484 42d20c 86483->86484 86491 42dbb9 86483->86491 86737 40c3e0 74 API calls 86483->86737 86738 40c620 117 API calls 86483->86738 86740 40be00 74 API calls 86483->86740 86741 40e380 VariantClear 86483->86741 86484->86342 86739 410ae0 VariantClear 86488->86739 86498 40a481 86489->86498 86755 40c8a0 VariantClear 86489->86755 86490 402cc0 74 API calls 86490->86515 86491->86443 86735 401380 74 API calls 86493->86735 86496 4092c0 VariantClear 86528 40a534 86496->86528 86497 411421 73 API calls 86497->86515 86499 40a4ed 86498->86499 86501 42dc1e VariantClear 86498->86501 86498->86528 86505 40a4ff 86499->86505 86756 40e380 VariantClear 86499->86756 86500 41171a 74 API calls 86500->86515 86501->86505 86504 41171a 74 API calls 86504->86528 86505->86504 86505->86528 86509 44b3f6 74 API calls 86509->86515 86510 42deb6 VariantClear 86510->86528 86511 40a73c 86513 42e237 86511->86513 86521 40a76b 86511->86521 86512 40e380 VariantClear 86512->86528 86760 46e709 VariantClear VariantClear 86513->86760 86753 4721e5 VariantClear 86514->86753 86515->86462 86515->86474 86515->86490 86515->86493 86515->86497 86515->86500 86515->86509 86515->86514 86520 40a053 86515->86520 86749 45ee98 74 API calls 86515->86749 86750 4019e0 75 API calls 86515->86750 86751 404260 75 API calls 86515->86751 86752 409210 VariantClear 86515->86752 86516 42dfe9 VariantClear 86516->86528 86517 42df47 VariantClear 86517->86528 86518 40a7a2 86533 40a7ad 86518->86533 86761 40b800 VariantClear VariantClear 86518->86761 86520->86342 86521->86518 86543 40a800 86521->86543 86734 40b800 VariantClear VariantClear 86521->86734 86524 41171a 74 API calls 86524->86528 86525 40a8b0 86539 40a8c2 86525->86539 86763 40e380 VariantClear 86525->86763 86526 42e312 86529 42e337 VariantClear 86526->86529 86526->86539 86527 41171a 74 API calls 86530 42dd10 VariantInit VariantCopy 86527->86530 86528->86496 86528->86510 86528->86511 86528->86512 86528->86513 86528->86516 86528->86517 86528->86524 86528->86527 86757 46e9cd 74 API calls 86528->86757 86758 409210 VariantClear 86528->86758 86759 44cc6c VariantClear 86528->86759 86529->86539 86530->86528 86532 42dd30 VariantClear 86530->86532 86531 42e3b2 86540 42e3da VariantClear 86531->86540 86547 40a91a 86531->86547 86532->86528 86534 40a7ee 86533->86534 86536 42e2a7 VariantClear 86533->86536 86533->86543 86534->86543 86762 40e380 VariantClear 86534->86762 86536->86543 86537 40a908 86537->86547 86764 40e380 VariantClear 86537->86764 86539->86531 86539->86537 86540->86547 86542 42e47f 86546 42e4a3 VariantClear 86542->86546 86552 40a957 86542->86552 86543->86525 86543->86526 86544 40a945 86544->86552 86765 40e380 VariantClear 86544->86765 86546->86552 86547->86542 86547->86544 86549 40aa22 86549->86342 86550 42e559 VariantClear 86550->86552 86552->86549 86552->86550 86766 40e380 VariantClear 86552->86766 86553->86309 86554->86338 86555->86338 86556->86338 86557->86338 86558->86338 86559->86338 86561 40412e 86560->86561 86562 4092c0 VariantClear 86561->86562 86563 404138 86562->86563 86563->86333 86564->86338 86565->86338 86566->86342 86567->86308 86568->86342 86569->86342 86570->86351 86571->86355 86572->86370 86573->86371 86574->86358 86575->86399 86576->86397 86577->86403 86578->86399 86579->86393 86580->86399 86581->86393 86582->86399 86583->86385 86584->86393 86585->86390 86586->86393 86587->86383 86588->86407 86590 4092c0 VariantClear 86589->86590 86591 40416e 86590->86591 86592 404120 VariantClear 86591->86592 86593 40419b 86592->86593 86599 4734b7 86593->86599 86643 40efe0 86593->86643 86594 4041c6 86594->86408 86594->86418 86597->86408 86598->86410 86600 453063 110 API calls 86599->86600 86601 4734d7 86600->86601 86602 473545 86601->86602 86603 47350c 86601->86603 86651 463c42 86602->86651 86604 4092c0 VariantClear 86603->86604 86610 473514 86604->86610 86606 473558 86607 47355c 86606->86607 86614 473595 86606->86614 86609 4092c0 VariantClear 86607->86609 86608 473616 86664 463d7e 86608->86664 86620 473564 86609->86620 86610->86594 86612 453063 110 API calls 86612->86614 86613 473622 86615 473697 86613->86615 86616 47362c 86613->86616 86614->86608 86614->86612 86623 473655 86614->86623 86710 462f5a 86 API calls 86614->86710 86698 457838 86615->86698 86619 4092c0 VariantClear 86616->86619 86621 473634 86619->86621 86620->86594 86621->86594 86626 4092c0 VariantClear 86623->86626 86637 47365d 86626->86637 86627 4736b0 86711 45e62e 115 API calls 86627->86711 86628 4736c9 86712 40e7e0 75 API calls 86628->86712 86631 4736ba GetCurrentProcess TerminateProcess 86631->86628 86632 4736db 86641 4736ff 86632->86641 86713 40d030 75 API calls 86632->86713 86634 473731 86639 473744 FreeLibrary 86634->86639 86640 47374b 86634->86640 86635 4736f1 86714 46b945 133 API calls 86635->86714 86637->86594 86639->86640 86640->86594 86641->86634 86715 40d030 75 API calls 86641->86715 86716 46b945 133 API calls 86641->86716 86644 40eff5 CreateFileW 86643->86644 86645 4299bf 86643->86645 86646 40f017 86644->86646 86645->86646 86647 4299c4 CreateFileW 86645->86647 86646->86594 86647->86646 86648 4299ea 86647->86648 86732 40e0d0 SetFilePointerEx SetFilePointerEx 86648->86732 86650 4299f5 86650->86646 86717 45335b 75 API calls 86651->86717 86653 463c5d 86718 442c52 79 API calls 86653->86718 86655 463c72 86657 40c060 74 API calls 86655->86657 86663 463cac 86655->86663 86658 463c8e 86657->86658 86719 4608ce 74 API calls 86658->86719 86660 463ca4 86661 40c740 74 API calls 86660->86661 86661->86663 86662 463cf7 86662->86606 86663->86662 86720 462f5a 86 API calls 86663->86720 86665 453063 110 API calls 86664->86665 86666 463d99 86665->86666 86667 463de0 86666->86667 86668 463dca 86666->86668 86722 40c760 77 API calls 86667->86722 86721 453081 110 API calls 86668->86721 86671 463dd0 LoadLibraryW 86673 463e09 86671->86673 86672 463de7 86677 463e19 86672->86677 86723 40c760 77 API calls 86672->86723 86675 463e3e 86673->86675 86673->86677 86678 463e4e 86675->86678 86679 463e7b 86675->86679 86676 463dfb 86676->86677 86724 40c760 77 API calls 86676->86724 86677->86613 86725 40d500 74 API calls 86678->86725 86727 40c760 77 API calls 86679->86727 86683 463e57 86726 45efe7 76 API calls 86683->86726 86684 463e82 GetProcAddress 86687 463e90 86684->86687 86686 463e62 GetProcAddress 86689 463e79 86686->86689 86687->86677 86688 463edf 86687->86688 86687->86689 86688->86677 86692 463eef FreeLibrary 86688->86692 86689->86687 86728 403470 74 API calls 86689->86728 86691 463eb4 86729 40d500 74 API calls 86691->86729 86692->86677 86694 463ebd 86730 45efe7 76 API calls 86694->86730 86696 463ec8 GetProcAddress 86731 401330 86696->86731 86699 457a4c 86698->86699 86705 45785f 86698->86705 86706 410d40 86699->86706 86700 40c760 77 API calls 86700->86705 86701 443576 77 API calls 86701->86705 86702 453081 110 API calls 86702->86705 86703 4138ba 66 API calls 86703->86705 86704 40f580 76 API calls 86704->86705 86705->86699 86705->86700 86705->86701 86705->86702 86705->86703 86705->86704 86708 410d55 86706->86708 86707 410ded VirtualProtect 86709 410dbb 86707->86709 86708->86707 86708->86709 86709->86627 86709->86628 86710->86614 86711->86631 86712->86632 86713->86635 86714->86641 86715->86641 86716->86641 86717->86653 86718->86655 86719->86660 86720->86662 86721->86671 86722->86672 86723->86676 86724->86673 86725->86683 86726->86686 86727->86684 86728->86691 86729->86694 86730->86696 86731->86688 86732->86650 86733->86428 86734->86518 86735->86436 86736->86442 86737->86483 86738->86483 86739->86549 86740->86483 86741->86483 86742->86459 86743->86477 86744->86481 86745->86453 86746->86456 86747->86460 86748->86515 86749->86515 86750->86515 86751->86515 86752->86515 86753->86474 86754->86491 86755->86489 86756->86505 86757->86528 86758->86528 86759->86528 86760->86518 86761->86533 86762->86543 86763->86539 86764->86547 86765->86552 86766->86552 86767->86491 86768->86446 86769 44f23f8 86783 44f0048 86769->86783 86771 44f24be 86786 44f22e8 86771->86786 86773 44f24e7 CreateFileW 86775 44f253b 86773->86775 86779 44f2536 86773->86779 86776 44f2552 VirtualAlloc 86775->86776 86775->86779 86777 44f2570 ReadFile 86776->86777 86776->86779 86778 44f258b 86777->86778 86777->86779 86780 44f12e8 13 API calls 86778->86780 86781 44f25be 86780->86781 86782 44f25e1 ExitProcess 86781->86782 86782->86779 86789 44f34e8 GetPEB 86783->86789 86785 44f06d3 86785->86771 86787 44f22f1 Sleep 86786->86787 86788 44f22ff 86787->86788 86790 44f3512 86789->86790 86790->86785 84821 46d22f 84824 46d098 84821->84824 84823 46d241 84825 46d0b5 84824->84825 84826 46d115 84825->84826 84827 46d0b9 84825->84827 84895 45c216 77 API calls 84826->84895 84872 41171a 84827->84872 84831 46d126 84832 46d0f8 84831->84832 84839 46d142 84831->84839 84891 4092c0 84832->84891 84833 46d0cc 84885 453063 84833->84885 84837 46d0fd 84837->84823 84840 46d1c8 84839->84840 84842 46d158 84839->84842 84901 4676a3 77 API calls 84840->84901 84845 453063 110 API calls 84842->84845 84843 46d0ea 84843->84839 84846 46d0ee 84843->84846 84853 46d15e 84845->84853 84846->84832 84890 44ade5 CloseHandle 84846->84890 84847 46d1ce 84902 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84847->84902 84848 46d18d 84896 467fce 81 API calls 84848->84896 84852 46d196 84897 4013a0 74 API calls 84852->84897 84853->84848 84853->84852 84854 46d194 84862 46d224 84854->84862 84868 40d900 84854->84868 84855 46d1e7 84855->84854 84858 4092c0 VariantClear 84855->84858 84857 46d1a2 84898 40df50 74 API calls 84857->84898 84858->84854 84860 46d1ac 84899 40d3b0 74 API calls 84860->84899 84862->84823 84863 46d1b8 84900 467fce 81 API calls 84863->84900 84866 46d216 84903 44ade5 CloseHandle 84866->84903 84869 40d917 84868->84869 84870 40d909 84868->84870 84869->84870 84871 40d91c CloseHandle 84869->84871 84870->84866 84871->84866 84876 411724 84872->84876 84874 41173e 84874->84833 84884 40d940 75 API calls 84874->84884 84876->84874 84879 411740 84876->84879 84904 4138ba 84876->84904 84922 411afc 6 API calls 84876->84922 84877 411766 84926 4116fd 66 API calls 84877->84926 84879->84877 84923 411421 84879->84923 84880 411770 84927 41805b RaiseException 84880->84927 84883 41177e 84884->84833 84886 45306e 84885->84886 84887 45307a 84885->84887 84886->84887 85065 452e2a 110 API calls 84886->85065 84889 40dfa0 82 API calls 84887->84889 84889->84843 84890->84832 84893 4092c8 84891->84893 84892 4092d5 84892->84837 84893->84892 84894 429db0 VariantClear 84893->84894 84894->84892 84895->84831 84896->84854 84897->84857 84898->84860 84899->84863 84900->84854 84901->84847 84902->84855 84903->84862 84905 41396d 84904->84905 84916 4138cc 84904->84916 84935 411afc 6 API calls 84905->84935 84907 413973 84936 417f23 66 API calls 84907->84936 84910 413965 84910->84876 84913 413929 RtlAllocateHeap 84913->84916 84914 4138dd 84914->84916 84928 418252 66 API calls 84914->84928 84929 4180a7 66 API calls 84914->84929 84930 411803 GetModuleHandleW GetProcAddress ExitProcess 84914->84930 84916->84910 84916->84913 84916->84914 84917 413959 84916->84917 84920 41395e 84916->84920 84931 41386b 66 API calls 84916->84931 84932 411afc 6 API calls 84916->84932 84933 417f23 66 API calls 84917->84933 84934 417f23 66 API calls 84920->84934 84922->84876 84937 4113e5 84923->84937 84925 41142e 84925->84877 84926->84880 84927->84883 84928->84914 84929->84914 84931->84916 84932->84916 84933->84920 84934->84910 84935->84907 84936->84910 84938 4113f1 84937->84938 84945 41181b 84938->84945 84944 411412 84944->84925 84971 418407 84945->84971 84947 4113f6 84948 4112fa 84947->84948 85036 4169e9 TlsGetValue 84948->85036 84951 4169e9 6 API calls 84952 41131e 84951->84952 84962 4113a1 84952->84962 85046 4170e7 67 API calls 84952->85046 84954 41133c 84957 411357 84954->84957 84958 411366 84954->84958 84967 411388 84954->84967 84955 41696e 6 API calls 84956 411396 84955->84956 84959 41696e 6 API calls 84956->84959 85047 417047 72 API calls 84957->85047 84961 411360 84958->84961 84958->84962 84959->84962 84961->84958 84964 41137c 84961->84964 85048 417047 72 API calls 84961->85048 84968 41141b 84962->84968 85049 41696e TlsGetValue 84964->85049 84965 411376 84965->84962 84965->84964 84967->84955 85061 411824 84968->85061 84972 41841c 84971->84972 84973 41842f RtlEnterCriticalSection 84971->84973 84978 418344 84972->84978 84973->84947 84975 418422 84975->84973 85006 4117af 66 API calls 84975->85006 84977 41842e 84977->84973 84979 418350 84978->84979 84980 418360 84979->84980 84982 418378 84979->84982 85007 418252 66 API calls 84980->85007 84984 418386 84982->84984 85010 416fb6 84982->85010 84983 418365 85008 4180a7 66 API calls 84983->85008 84984->84975 84988 41836c 85009 411803 GetModuleHandleW GetProcAddress ExitProcess 84988->85009 84989 4183a7 84991 418407 66 API calls 84989->84991 84990 418398 85016 417f23 66 API calls 84990->85016 84994 4183ae 84991->84994 84996 4183e2 84994->84996 84997 4183b6 84994->84997 84999 413a88 66 API calls 84996->84999 85017 4189e6 InitializeCriticalSectionAndSpinCount 84997->85017 85001 4183d3 84999->85001 85000 4183c1 85000->85001 85018 413a88 85000->85018 85032 4183fe RtlLeaveCriticalSection 85001->85032 85004 4183cd 85031 417f23 66 API calls 85004->85031 85006->84977 85007->84983 85008->84988 85013 416fbf 85010->85013 85011 4138ba 65 API calls 85011->85013 85012 416ff5 85012->84989 85012->84990 85013->85011 85013->85012 85014 416fd6 Sleep 85013->85014 85015 416feb 85014->85015 85015->85012 85015->85013 85016->84984 85017->85000 85020 413a94 85018->85020 85019 413b0d 85019->85004 85020->85019 85021 413ad3 85020->85021 85023 418407 64 API calls 85020->85023 85021->85019 85022 413ae8 RtlFreeHeap 85021->85022 85022->85019 85024 413afa 85022->85024 85025 413aab 85023->85025 85035 417f23 66 API calls 85024->85035 85028 413ac5 85025->85028 85033 419f9d VirtualFree VirtualFree HeapFree 85025->85033 85027 413aff GetLastError 85027->85019 85034 413ade RtlLeaveCriticalSection 85028->85034 85031->85001 85032->84984 85033->85028 85034->85021 85035->85027 85037 416a01 85036->85037 85038 416a22 GetModuleHandleW 85036->85038 85037->85038 85039 416a0b TlsGetValue 85037->85039 85040 416a32 85038->85040 85041 416a3d GetProcAddress 85038->85041 85043 416a16 85039->85043 85059 41177f Sleep GetModuleHandleW 85040->85059 85045 41130e 85041->85045 85043->85038 85043->85045 85044 416a38 85044->85041 85044->85045 85045->84951 85046->84954 85047->84961 85048->84965 85050 4169a7 GetModuleHandleW 85049->85050 85051 416986 85049->85051 85053 4169c2 GetProcAddress 85050->85053 85054 4169b7 85050->85054 85051->85050 85052 416990 TlsGetValue 85051->85052 85058 41699b 85052->85058 85057 41699f 85053->85057 85060 41177f Sleep GetModuleHandleW 85054->85060 85056 4169bd 85056->85053 85056->85057 85057->84967 85058->85050 85058->85057 85059->85044 85060->85056 85064 41832d RtlLeaveCriticalSection 85061->85064 85063 411420 85063->84944 85064->85063 85065->84887 86791 42919b 86796 40ef10 86791->86796 86794 411421 73 API calls 86795 4291aa 86794->86795 86797 41171a 74 API calls 86796->86797 86798 40ef17 86797->86798 86799 42ad48 86798->86799 86804 40ef40 73 API calls 86798->86804 86801 40ef2a 86805 40e470 86801->86805 86804->86801 86806 40c060 74 API calls 86805->86806 86807 40e483 GetVersionExW 86806->86807 86808 4021e0 74 API calls 86807->86808 86809 40e4bb 86808->86809 86831 40e600 86809->86831 86815 42accc 86819 42ad28 GetSystemInfo 86815->86819 86817 40e557 GetCurrentProcess 86851 40ee30 LoadLibraryA GetProcAddress 86817->86851 86818 40e56c 86821 42ad38 GetSystemInfo 86818->86821 86844 40eee0 86818->86844 86819->86821 86824 40e5c9 86848 40eea0 86824->86848 86827 40e5e0 86829 40e5f1 FreeLibrary 86827->86829 86830 40e5f4 86827->86830 86828 40e5dd FreeLibrary 86828->86827 86829->86830 86830->86794 86832 40e60b 86831->86832 86833 40c740 74 API calls 86832->86833 86834 40e4c2 86833->86834 86835 40e620 86834->86835 86836 40e62a 86835->86836 86837 42ac93 86836->86837 86838 40c740 74 API calls 86836->86838 86839 40e4ce 86838->86839 86839->86815 86840 40ee70 86839->86840 86841 40e551 86840->86841 86842 40ee76 LoadLibraryA 86840->86842 86841->86817 86841->86818 86842->86841 86843 40ee87 GetProcAddress 86842->86843 86843->86841 86845 40e5bf 86844->86845 86846 40eee6 LoadLibraryA 86844->86846 86845->86819 86845->86824 86846->86845 86847 40eef7 GetProcAddress 86846->86847 86847->86845 86852 40eec0 LoadLibraryA GetProcAddress 86848->86852 86850 40e5d3 GetNativeSystemInfo 86850->86827 86850->86828 86851->86818 86852->86850 86853 42e89e 86860 40c000 86853->86860 86855 42e8ac 86856 409a40 164 API calls 86855->86856 86857 42e8ca 86856->86857 86871 44b92e VariantClear 86857->86871 86859 42f3ae 86861 40c014 86860->86861 86862 40c007 86860->86862 86864 40c01a 86861->86864 86865 40c02c 86861->86865 86872 409210 VariantClear 86862->86872 86873 409210 VariantClear 86864->86873 86867 41171a 74 API calls 86865->86867 86870 40c033 86867->86870 86868 40c00f 86868->86855 86869 40c023 86869->86855 86870->86855 86871->86859 86872->86868 86873->86869

                                                                                        Executed Functions

                                                                                        Function 00409A40 Relevance: 30.4, APIs: 14, Strings: 2, Instructions: 2432COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BuffCharUpper
                                                                                        • String ID: 0vH$4RH
                                                                                        • API String ID: 3964851224-2085553193
                                                                                        • Opcode ID: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                        • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                        • Opcode Fuzzy Hash: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                                        • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                        Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1123 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1132 40e506-40e509 1123->1132 1133 42accc-42acd1 1123->1133 1136 40e540-40e555 call 40ee70 1132->1136 1137 40e50b-40e51c 1132->1137 1134 42acd3-42acdb 1133->1134 1135 42acdd-42ace0 1133->1135 1138 42ad12-42ad20 1134->1138 1139 42ace2-42aceb 1135->1139 1140 42aced-42acf0 1135->1140 1149 40e557-40e573 GetCurrentProcess call 40ee30 1136->1149 1150 40e579-40e5a8 1136->1150 1141 40e522-40e525 1137->1141 1142 42ac9b-42aca7 1137->1142 1155 42ad28-42ad2d GetSystemInfo 1138->1155 1139->1138 1140->1138 1146 42acf2-42ad06 1140->1146 1141->1136 1147 40e527-40e537 1141->1147 1144 42acb2-42acba 1142->1144 1145 42aca9-42acad 1142->1145 1144->1136 1145->1136 1151 42ad08-42ad0c 1146->1151 1152 42ad0e 1146->1152 1153 42acbf-42acc7 1147->1153 1154 40e53d 1147->1154 1149->1150 1164 40e575 1149->1164 1157 42ad38-42ad3d GetSystemInfo 1150->1157 1158 40e5ae-40e5c3 call 40eee0 1150->1158 1151->1138 1152->1138 1153->1136 1154->1136 1155->1157 1158->1155 1163 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1158->1163 1167 40e5e0-40e5ef 1163->1167 1168 40e5dd-40e5de FreeLibrary 1163->1168 1164->1150 1169 40e5f1-40e5f2 FreeLibrary 1167->1169 1170 40e5f4-40e5ff 1167->1170 1168->1167 1169->1170
                                                                                        APIs
                                                                                        • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                        • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                        • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion
                                                                                        • String ID: pMH
                                                                                        • API String ID: 3079510601-2522892712
                                                                                        • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                        • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                        • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                        • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                        Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1713 40eb70-40eb74 1714 40eb96 1713->1714 1715 40eb76-40eb85 LoadLibraryA 1713->1715 1715->1714 1716 40eb87-40eb93 GetProcAddress 1715->1716 1716->1714
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                        • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: IsThemeActive$uxtheme.dll
                                                                                        • API String ID: 2574300362-3542929980
                                                                                        • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                        • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                        • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                        • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                        Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                        • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                        • timeGetTime.WINMM ref: 00409880
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BuffCharSleepTimeUppertime
                                                                                        • String ID:
                                                                                        • API String ID: 2141449944-0
                                                                                        • Opcode ID: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                        • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                        • Opcode Fuzzy Hash: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                        • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                        Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                        • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                        • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                        • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                        • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                        • RegisterClassExW.USER32 ref: 004102C6
                                                                                          • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                          • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                          • Part of subcall function 004102F0: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 0041036A
                                                                                          • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
                                                                                        • String ID: #$0$PGH
                                                                                        • API String ID: 2880975755-3673556320
                                                                                        • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                        • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                        • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                        • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                        Function 004255C4 Relevance: 14.1, APIs: 9, Instructions: 579fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(00000080,00000000,00000080,0000000C,00000001,00000080,00000000,00000109,00000000,00000109), ref: 004257F3
                                                                                        • CreateFileW.KERNEL32(00000080,7FFFFFFF,00000001,0000000C,00000001,00000080,00000000), ref: 0042582C
                                                                                        • GetLastError.KERNEL32 ref: 00425851
                                                                                        • GetFileType.KERNELBASE(?), ref: 0042586D
                                                                                        • GetLastError.KERNEL32 ref: 00425892
                                                                                        • CloseHandle.KERNEL32(?), ref: 004258A4
                                                                                        • CloseHandle.KERNEL32(?), ref: 00425C6A
                                                                                        • CreateFileW.KERNEL32(00000080,00000000,00000001,0000000C,00000003,00000080,00000000), ref: 00425C87
                                                                                        • GetLastError.KERNEL32 ref: 00425C92
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CreateErrorLast$CloseHandle$Type
                                                                                        • String ID:
                                                                                        • API String ID: 352418905-0
                                                                                        • Opcode ID: 9a2842c33dd42d113f273929bf8fd8cb84c1a2513e7f56b17b889415b9c929d6
                                                                                        • Instruction ID: 669c70fe02d08c48a4bfc23b5c295140071241b72d0cac454048e7f20503c7df
                                                                                        • Opcode Fuzzy Hash: 9a2842c33dd42d113f273929bf8fd8cb84c1a2513e7f56b17b889415b9c929d6
                                                                                        • Instruction Fuzzy Hash: DF222371A00A299BDF219F68E8857AE7BB1EF01314FA4066AE451D7391D33D8D80CB59
                                                                                        Function 004102F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53registrywindowclipboardCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetSysColorBrush.USER32 ref: 00410326
                                                                                        • RegisterClassExW.USER32 ref: 00410359
                                                                                        • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 0041036A
                                                                                        • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Register$BrushClassClipboardColorFormatIconLoad
                                                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                        • API String ID: 975902462-1005189915
                                                                                        • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                        • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                        • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                        • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                        Function 0041E7DC Relevance: 12.5, APIs: 8, Instructions: 520COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: ec6185bb95033948424997075615cd394999d7b3352a51c3c84c5f176d9edcdf
                                                                                        • Instruction ID: 60237bb9b030d907ca0bd1bf58dcbb3909e656aee1947051e473b0785f795cf0
                                                                                        • Opcode Fuzzy Hash: ec6185bb95033948424997075615cd394999d7b3352a51c3c84c5f176d9edcdf
                                                                                        • Instruction Fuzzy Hash: E112A4789042869FDB21DF6AC8847EA7BF0BF06304F14459FED6287292D37899C1CB59
                                                                                        Function 00410B90 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 167registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1558 410b90-410cf1 call 425210 call 41171a GetModuleFileNameW call 413db0 call 413dfc call 413e3c call 41171a call 411691 RegOpenKeyExW 1573 429bc3-429bec RegQueryValueExW 1558->1573 1574 410cf7-410d03 1558->1574 1575 429bf2-429c18 1573->1575 1576 429cd9-429cde RegCloseKey 1573->1576 1577 429c1f-429c31 1575->1577 1578 429c33-429c37 1577->1578 1579 429c50-429c5f call 4112d5 1577->1579 1578->1579 1580 429c39-429c48 call 411663 1578->1580 1585 429c61-429c74 call 4112d5 1579->1585 1586 429c88-429cd2 call 41171a call 41326a 1579->1586 1587 429c4b-429c4e 1580->1587 1585->1586 1593 429c76-429c85 call 411663 1585->1593 1586->1587 1596 429cd8 1586->1596 1587->1577 1593->1586 1596->1576
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseFileModuleNameOpenQueryValue
                                                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                        • API String ID: 3617018055-2276155026
                                                                                        • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                        • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                        • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                        • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                        Function 044F2638 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1598 44f2638-44f26e6 call 44f0048 1601 44f26ed-44f2713 call 44f3548 CreateFileW 1598->1601 1604 44f271a-44f272a 1601->1604 1605 44f2715 1601->1605 1612 44f272c 1604->1612 1613 44f2731-44f274b VirtualAlloc 1604->1613 1606 44f2865-44f2869 1605->1606 1607 44f28ab-44f28ae 1606->1607 1608 44f286b-44f286f 1606->1608 1614 44f28b1-44f28b8 1607->1614 1610 44f287b-44f287f 1608->1610 1611 44f2871-44f2874 1608->1611 1615 44f288f-44f2893 1610->1615 1616 44f2881-44f288b 1610->1616 1611->1610 1612->1606 1617 44f274d 1613->1617 1618 44f2752-44f2769 ReadFile 1613->1618 1619 44f290d-44f2922 1614->1619 1620 44f28ba-44f28c5 1614->1620 1623 44f2895-44f289f 1615->1623 1624 44f28a3 1615->1624 1616->1615 1617->1606 1625 44f276b 1618->1625 1626 44f2770-44f27b0 VirtualAlloc 1618->1626 1621 44f2924-44f292f VirtualFree 1619->1621 1622 44f2932-44f293a 1619->1622 1627 44f28c9-44f28d5 1620->1627 1628 44f28c7 1620->1628 1621->1622 1623->1624 1624->1607 1625->1606 1631 44f27b7-44f27d2 call 44f3798 1626->1631 1632 44f27b2 1626->1632 1629 44f28e9-44f28f5 1627->1629 1630 44f28d7-44f28e7 1627->1630 1628->1619 1634 44f28f7-44f2900 1629->1634 1635 44f2902-44f2908 1629->1635 1633 44f290b 1630->1633 1638 44f27dd-44f27e7 1631->1638 1632->1606 1633->1614 1634->1633 1635->1633 1639 44f281a-44f282e call 44f35a8 1638->1639 1640 44f27e9-44f2818 call 44f3798 1638->1640 1646 44f2832-44f2836 1639->1646 1647 44f2830 1639->1647 1640->1638 1648 44f2838-44f283c CloseHandle 1646->1648 1649 44f2842-44f2846 1646->1649 1647->1606 1648->1649 1650 44f2848-44f2853 VirtualFree 1649->1650 1651 44f2856-44f285f 1649->1651 1650->1651 1651->1601 1651->1606
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 044F2709
                                                                                        • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 044F292F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFileFreeVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 204039940-0
                                                                                        • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                                        • Instruction ID: a76d820d801c8a156f083997a5ca39e05c10b499f5f4a9e7defecc79edf9726a
                                                                                        • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                                        • Instruction Fuzzy Hash: 7AA1EC74E00209EBDF14CFA4C894BEEBBB5BF48304F10859AE615BB280D7B66A41DF55
                                                                                        Function 00401230 Relevance: 10.6, APIs: 7, Instructions: 83windowtimeCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1652 401230-40123b 1653 401241-401272 call 4131f0 call 401be0 1652->1653 1654 4012c5-4012cd 1652->1654 1659 401274-401292 1653->1659 1660 4012ae-4012bf KillTimer SetTimer 1653->1660 1661 42aa61-42aa67 1659->1661 1662 401298-40129c 1659->1662 1660->1654 1665 42aa8b-42aaa7 Shell_NotifyIconW 1661->1665 1666 42aa69-42aa86 Shell_NotifyIconW 1661->1666 1663 4012a2-4012a8 1662->1663 1664 42aaac-42aab3 1662->1664 1663->1660 1667 42aaf8-42ab15 Shell_NotifyIconW 1663->1667 1668 42aad7-42aaf3 Shell_NotifyIconW 1664->1668 1669 42aab5-42aad2 Shell_NotifyIconW 1664->1669 1665->1660 1666->1660 1667->1660 1668->1660 1669->1660
                                                                                        APIs
                                                                                          • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                        • KillTimer.USER32(?,?), ref: 004012B0
                                                                                        • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: IconNotifyShell_$Timer$Kill
                                                                                        • String ID:
                                                                                        • API String ID: 3970887597-0
                                                                                        • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                        • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                        • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                        • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                        Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1670 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                        APIs
                                                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                        • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                        • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$CreateShow
                                                                                        • String ID: AutoIt v3$edit
                                                                                        • API String ID: 1584632944-3779509399
                                                                                        • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                        • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                        • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                        • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                        Function 044F23F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 149fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1671 44f23f8-44f2534 call 44f0048 call 44f22e8 CreateFileW 1678 44f253b-44f254b 1671->1678 1679 44f2536 1671->1679 1682 44f254d 1678->1682 1683 44f2552-44f256c VirtualAlloc 1678->1683 1680 44f25eb-44f25f0 1679->1680 1682->1680 1684 44f256e 1683->1684 1685 44f2570-44f2587 ReadFile 1683->1685 1684->1680 1686 44f258b-44f25c5 call 44f2328 call 44f12e8 1685->1686 1687 44f2589 1685->1687 1692 44f25c7-44f25dc call 44f2378 1686->1692 1693 44f25e1-44f25e9 ExitProcess 1686->1693 1687->1680 1692->1693 1693->1680
                                                                                        APIs
                                                                                          • Part of subcall function 044F22E8: Sleep.KERNELBASE(000001F4), ref: 044F22F9
                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 044F252A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFileSleep
                                                                                        • String ID: P86OG7HE9PYGZUVUEN1JRWBI426
                                                                                        • API String ID: 2694422964-783456473
                                                                                        • Opcode ID: 46dba1367561fb9e402c332490dd0bfe7f22170a5874b7303b5078078a08a1c4
                                                                                        • Instruction ID: dd7d8cf79c90158d7a6986906bf5330cc626dae749e9274d392092b0b798ba7d
                                                                                        • Opcode Fuzzy Hash: 46dba1367561fb9e402c332490dd0bfe7f22170a5874b7303b5078078a08a1c4
                                                                                        • Instruction Fuzzy Hash: 6D516130D04288DAEF12DBE4CC54BEFBB78AF15304F044599E2487B2C1D6BA1B49CB66
                                                                                        Function 00410130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1695 410130-410142 SHGetMalloc 1696 410148-410158 SHGetDesktopFolder 1695->1696 1697 42944f-429459 call 411691 1695->1697 1698 4101d1-4101e0 1696->1698 1699 41015a-410188 call 411691 1696->1699 1698->1697 1705 4101e6-4101ee 1698->1705 1707 4101c5-4101ce 1699->1707 1708 41018a-4101a1 SHGetPathFromIDListW 1699->1708 1707->1698 1709 4101a3-4101b1 call 411691 1708->1709 1710 4101b4-4101c0 1708->1710 1709->1710 1710->1707
                                                                                        APIs
                                                                                        • SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                        • SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                        • SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DesktopFolderFromListMallocPath
                                                                                        • String ID: C:\Users\user\Desktop\Payment Advice.exe
                                                                                        • API String ID: 2281215042-742037611
                                                                                        • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                        • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                        • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                        • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                        Function 044F12E8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1717 44f12e8-44f1388 call 44f3778 * 3 1724 44f139f 1717->1724 1725 44f138a-44f1394 1717->1725 1727 44f13a6-44f13af 1724->1727 1725->1724 1726 44f1396-44f139d 1725->1726 1726->1727 1728 44f13b6-44f1a68 1727->1728 1729 44f1a7b-44f1aa8 CreateProcessW 1728->1729 1730 44f1a6a-44f1a6e 1728->1730 1737 44f1aaa-44f1aad 1729->1737 1738 44f1ab2 1729->1738 1731 44f1ab4-44f1ae1 1730->1731 1732 44f1a70-44f1a74 1730->1732 1748 44f1aeb 1731->1748 1749 44f1ae3-44f1ae6 1731->1749 1733 44f1aed-44f1b1a 1732->1733 1734 44f1a76 1732->1734 1736 44f1b24-44f1b3e Wow64GetThreadContext 1733->1736 1758 44f1b1c-44f1b1f 1733->1758 1734->1736 1741 44f1b45-44f1b60 ReadProcessMemory 1736->1741 1742 44f1b40 1736->1742 1743 44f1ea9-44f1eab 1737->1743 1738->1736 1746 44f1b67-44f1b70 1741->1746 1747 44f1b62 1741->1747 1745 44f1e52-44f1e56 1742->1745 1750 44f1e58-44f1e5c 1745->1750 1751 44f1ea7 1745->1751 1753 44f1b99-44f1bb8 call 44f2df8 1746->1753 1754 44f1b72-44f1b81 1746->1754 1747->1745 1748->1736 1749->1743 1755 44f1e5e-44f1e6a 1750->1755 1756 44f1e71-44f1e75 1750->1756 1751->1743 1766 44f1bbf-44f1be2 call 44f2f38 1753->1766 1767 44f1bba 1753->1767 1754->1753 1759 44f1b83-44f1b92 call 44f2d48 1754->1759 1755->1756 1762 44f1e77-44f1e7a 1756->1762 1763 44f1e81-44f1e85 1756->1763 1758->1743 1759->1753 1770 44f1b94 1759->1770 1762->1763 1768 44f1e87-44f1e8a 1763->1768 1769 44f1e91-44f1e95 1763->1769 1776 44f1c2c-44f1c4d call 44f2f38 1766->1776 1777 44f1be4-44f1beb 1766->1777 1767->1745 1768->1769 1772 44f1e97-44f1e9d call 44f2d48 1769->1772 1773 44f1ea2-44f1ea5 1769->1773 1770->1745 1772->1773 1773->1743 1783 44f1c4f 1776->1783 1784 44f1c54-44f1c72 call 44f3798 1776->1784 1779 44f1bed-44f1c1e call 44f2f38 1777->1779 1780 44f1c27 1777->1780 1787 44f1c25 1779->1787 1788 44f1c20 1779->1788 1780->1745 1783->1745 1790 44f1c7d-44f1c87 1784->1790 1787->1776 1788->1745 1791 44f1cbd-44f1cc1 1790->1791 1792 44f1c89-44f1cbb call 44f3798 1790->1792 1794 44f1dac-44f1dc9 call 44f2948 1791->1794 1795 44f1cc7-44f1cd7 1791->1795 1792->1790 1803 44f1dcb 1794->1803 1804 44f1dd0-44f1def Wow64SetThreadContext 1794->1804 1795->1794 1798 44f1cdd-44f1ced 1795->1798 1798->1794 1799 44f1cf3-44f1d17 1798->1799 1802 44f1d1a-44f1d1e 1799->1802 1802->1794 1805 44f1d24-44f1d39 1802->1805 1803->1745 1806 44f1df3-44f1dfe call 44f2c78 1804->1806 1807 44f1df1 1804->1807 1809 44f1d4d-44f1d51 1805->1809 1813 44f1e02-44f1e06 1806->1813 1814 44f1e00 1806->1814 1807->1745 1811 44f1d8f-44f1da7 1809->1811 1812 44f1d53-44f1d5f 1809->1812 1811->1802 1815 44f1d8d 1812->1815 1816 44f1d61-44f1d8b 1812->1816 1817 44f1e08-44f1e0b 1813->1817 1818 44f1e12-44f1e16 1813->1818 1814->1745 1815->1809 1816->1815 1817->1818 1820 44f1e18-44f1e1b 1818->1820 1821 44f1e22-44f1e26 1818->1821 1820->1821 1822 44f1e28-44f1e2b 1821->1822 1823 44f1e32-44f1e36 1821->1823 1822->1823 1824 44f1e38-44f1e3e call 44f2d48 1823->1824 1825 44f1e43-44f1e4c 1823->1825 1824->1825 1825->1728 1825->1745
                                                                                        APIs
                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 044F1AA3
                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 044F1B39
                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 044F1B5B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                        • String ID:
                                                                                        • API String ID: 2438371351-0
                                                                                        • Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                                        • Instruction ID: 8a48235633e2e287c1d48ee43197447e9717eef66bebf299e62942a4694d159f
                                                                                        • Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                                        • Instruction Fuzzy Hash: 1F62DA30A14658DAEB24CFA4CC50BDEB376EF58700F1091A9D20DEB394E775AE81CB59
                                                                                        Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                        • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                        • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                        • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                        Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 1990 40f110-40f13a RegOpenKeyExW 1991 40f13c-40f159 RegQueryValueExW RegCloseKey 1990->1991 1992 40f15f-40f160 1990->1992 1991->1992
                                                                                        APIs
                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                        • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                        • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseOpenQueryValue
                                                                                        • String ID:
                                                                                        • API String ID: 3677997916-0
                                                                                        • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                        • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                        • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                        • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                        Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClearVariant
                                                                                        • String ID:
                                                                                        • API String ID: 1473721057-0
                                                                                        • Opcode ID: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                        • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                        • Opcode Fuzzy Hash: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                                        • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                        Function 00416193 Relevance: 3.1, APIs: 2, Instructions: 100COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStartupInfoW.KERNEL32(?,0048C920,00000058), ref: 004161A8
                                                                                        • GetCommandLineW.KERNEL32 ref: 0041623D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CommandInfoLineStartup
                                                                                        • String ID:
                                                                                        • API String ID: 582193876-0
                                                                                        • Opcode ID: 0ff05a0656d0cabc76cd69936c9fb6d5f070ff973f57c73f94411b1fd4ca271d
                                                                                        • Instruction ID: 4cece88e8d20870e626e2a15fe4d62767af7f5e44e91f32af7e3c33ec5ed94b3
                                                                                        • Opcode Fuzzy Hash: 0ff05a0656d0cabc76cd69936c9fb6d5f070ff973f57c73f94411b1fd4ca271d
                                                                                        • Instruction Fuzzy Hash: 5A31B771E40314E9DB10BBB2A9467EE2664AF1070CF1144AFF915AA2D3DBBCC9C18B5D
                                                                                        Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                        • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFile
                                                                                        • String ID:
                                                                                        • API String ID: 823142352-0
                                                                                        • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                        • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                        • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                        • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                        Function 0041EF5F Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointer.KERNELBASE(00000000,00000109,00000000,00425BA7,00074000,00000109,?,00425BA7,00000109,00000000,00000000), ref: 0041EF8E
                                                                                        • GetLastError.KERNEL32(?,00425BA7,00000109,00000000,00000000), ref: 0041EF9B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastPointer
                                                                                        • String ID:
                                                                                        • API String ID: 2976181284-0
                                                                                        • Opcode ID: d0e113ae251f39dc1295bd3d0d5c570924977ae37561d63c63e682e8777c236f
                                                                                        • Instruction ID: cf4b6fdaa65d58340d4e2f426219068bfe2c256bea3d67c41a1efc08f55daa7f
                                                                                        • Opcode Fuzzy Hash: d0e113ae251f39dc1295bd3d0d5c570924977ae37561d63c63e682e8777c236f
                                                                                        • Instruction Fuzzy Hash: 4401F4366145147BCA115BBAAC089DA3B699F82334B250726FE34CF1D1CB78C88297A9
                                                                                        Function 00413A88 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                        • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                          • Part of subcall function 00418407: RtlEnterCriticalSection.NTDLL(?), ref: 00418431
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection
                                                                                        • String ID:
                                                                                        • API String ID: 2972400715-0
                                                                                        • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                        • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                        • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                        • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                        Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Message$DispatchTranslate
                                                                                        • String ID:
                                                                                        • API String ID: 1706434739-0
                                                                                        • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                        • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                        • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                        • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                        Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Message$DispatchTranslate
                                                                                        • String ID:
                                                                                        • API String ID: 1706434739-0
                                                                                        • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                        • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                        • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                        • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                        Function 0041E517 Relevance: 2.6, APIs: 2, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNELBASE(00000000,00000000,00000109,?,0042595E,00000109), ref: 0041E569
                                                                                        • GetLastError.KERNEL32(?,0042595E,00000109), ref: 0041E573
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseErrorHandleLast
                                                                                        • String ID:
                                                                                        • API String ID: 918212764-0
                                                                                        • Opcode ID: bcac448e53919a337955079ba1fb01489cacc7633263b2fdf1f383f96fd6d644
                                                                                        • Instruction ID: 19e2beeb38f2cf2c4278f884dded42d16dad9246bf5dd3ae84917a532f316d83
                                                                                        • Opcode Fuzzy Hash: bcac448e53919a337955079ba1fb01489cacc7633263b2fdf1f383f96fd6d644
                                                                                        • Instruction Fuzzy Hash: 34010C3691512035C61162BA5905BEB26868F8273CF59011BFD18873D2FB6DCCC2829D
                                                                                        Function 044F12E5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 044F1AA3
                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 044F1B39
                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 044F1B5B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                        • String ID:
                                                                                        • API String ID: 2438371351-0
                                                                                        • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                                        • Instruction ID: 4c59b072031e8db2ebcf152017c95170321f279e44a7ee00bfc543ab2055e935
                                                                                        • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                                        • Instruction Fuzzy Hash: CC12DE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A5F81CF5A
                                                                                        Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ProtectVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 544645111-0
                                                                                        • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                        • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                        • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                        • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                        Function 004138BA Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(00000000,0041172A), ref: 00413931
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: 03b941ca31b2eefa3ee245af14a45a05522b7591dd32a7038f61ecb62e62ab21
                                                                                        • Instruction ID: ed42b26ac187221e93853d6dfd9c7f51b54a687a62893bdaf2a19a7afcae2479
                                                                                        • Opcode Fuzzy Hash: 03b941ca31b2eefa3ee245af14a45a05522b7591dd32a7038f61ecb62e62ab21
                                                                                        • Instruction Fuzzy Hash: F91106B25156155ADA112F2ADC01BEB7798DF0136AF11013BF940AB2A0CBEC8EC186DC
                                                                                        Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                        • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                        • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                        • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                        Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 10892065-0
                                                                                        • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                        • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                        • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                        • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                        Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                        • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$PointerWrite
                                                                                        • String ID:
                                                                                        • API String ID: 539440098-0
                                                                                        • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                        • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                        • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                        • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                        Function 00416FB6 Relevance: 1.3, APIs: 1, Instructions: 28sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A), ref: 00413931
                                                                                        • Sleep.KERNEL32(00000000,00000001,00411739,?,00418391,00000018,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00416FD7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeapSleep
                                                                                        • String ID:
                                                                                        • API String ID: 4201116106-0
                                                                                        • Opcode ID: 7351f003d9c4e269a066673786ffac8decad1e325cedd491f8ecc1fa6b0779cb
                                                                                        • Instruction ID: 62b9039d0dc2d1652bd8483666354cb4007973faf85ac804ab3d87b56acb7484
                                                                                        • Opcode Fuzzy Hash: 7351f003d9c4e269a066673786ffac8decad1e325cedd491f8ecc1fa6b0779cb
                                                                                        • Instruction Fuzzy Hash: 6DE0923290051557CB206A7AF8488CB7F9ADA913B5322077BF538C2390DA25CD86829C
                                                                                        Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandle
                                                                                        • String ID:
                                                                                        • API String ID: 2962429428-0
                                                                                        • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                        • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                        • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                        • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                        Function 044F22E8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNELBASE(000001F4), ref: 044F22F9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Sleep
                                                                                        • String ID:
                                                                                        • API String ID: 3472027048-0
                                                                                        • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                        • Instruction ID: 590e73c2a5156c4615cc3c7742827e8bce6e9a445849dfe06a59e471a96fca33
                                                                                        • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                        • Instruction Fuzzy Hash: E1E0E67494010DDFDB00DFB4DA4D69D7BB4FF04301F1005A1FD01E2280DA719D508A72

                                                                                        Non-executed Functions

                                                                                        Function 0047C08E Relevance: 65.4, APIs: 34, Strings: 3, Instructions: 676windowkeyboardnativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                        • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                        • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                        • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                        • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                        • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                        • SendMessageW.USER32 ref: 0047C2FB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$State$DialogNtdllProc_
                                                                                        • String ID: 0DNt$@GUI_DRAGID$F
                                                                                        • API String ID: 2436949396-2616026061
                                                                                        • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                        • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                        • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                        • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                        Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                        • IsIconic.USER32(?), ref: 004375E1
                                                                                        • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                        • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                        • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                        • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                        • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                        • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                        • String ID: Shell_TrayWnd
                                                                                        • API String ID: 3778422247-2988720461
                                                                                        • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                        • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                        • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                        • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                        Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                        • GetLastError.KERNEL32 ref: 004644B4
                                                                                        • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                        • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: OpenProcess$CurrentThreadToken$ErrorLast
                                                                                        • String ID: SeDebugPrivilege
                                                                                        • API String ID: 1606813200-2896544425
                                                                                        • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                        • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                        • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                        • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                        Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                          • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Payment Advice.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                        • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                        • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Payment Advice.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                          • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\Payment Advice.exe,00000004), ref: 0040D7D6
                                                                                        • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\Payment Advice.exe,00000004), ref: 00431B0E
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\Payment Advice.exe,00000004), ref: 00431B3F
                                                                                        • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                        • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                          • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                          • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                          • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                          • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                          • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: LoadWindow$IconName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_
                                                                                        • String ID: @GH$@GH$C:\Users\user\Desktop\Payment Advice.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                        • API String ID: 3436406043-794260907
                                                                                        • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                        • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                        • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                        • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                        Function 004461ED Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 227processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                        • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                        • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                        • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                        • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                        • 746A5590.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                        • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                        • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                        • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                        • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: StationWindow$CloseProcess$DesktopHandleOpen$A5590CreateDuplicateTokenUser
                                                                                        • String ID: $default$winsta0
                                                                                        • API String ID: 1099877030-1027155976
                                                                                        • Opcode ID: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                        • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                        • Opcode Fuzzy Hash: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                                        • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                        Function 00469681 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                        • GetFocus.USER32 ref: 004696E0
                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                        • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost$CtrlFocus
                                                                                        • String ID: 0
                                                                                        • API String ID: 1534620443-4108050209
                                                                                        • Opcode ID: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                        • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                        • Opcode Fuzzy Hash: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                                        • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                        Function 0046F2B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 185windowfilenativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                          • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                          • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                          • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                        • SendMessageW.USER32(?), ref: 0046F34C
                                                                                        • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                        • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                        • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                        • DragFinish.SHELL32(?), ref: 0046F414
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Drag$Query$FileRect$ClientDialogFinishNtdllPointProc_ScreenWindow
                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                        • API String ID: 2108730999-3440237614
                                                                                        • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                        • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                        • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                        • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                        Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                        • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                        • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                        • String ID: *.*
                                                                                        • API String ID: 1409584000-438819550
                                                                                        • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                        • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                        • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                        • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                        Function 0044BD29 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 178filestringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment Advice.exe,?,C:\Users\user\Desktop\Payment Advice.exe,004A8E80,C:\Users\user\Desktop\Payment Advice.exe,0040F3D2), ref: 0040FFCA
                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Find$CloseCopyDeleteMove$AttributesFirstFullNameNextPathlstrcmpi
                                                                                        • String ID: \*.*
                                                                                        • API String ID: 2518010859-1173974218
                                                                                        • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                        • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                        • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                        • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                        Function 00442E1F Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 134fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(?,75C78FB0,75C78FB0,?,?,00000000), ref: 00442E40
                                                                                        • FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 00442EA4
                                                                                        • FindClose.KERNEL32(00000000,?,00000000), ref: 00442EB5
                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00442ED1
                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00442EF0
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00442F3B
                                                                                        • SetCurrentDirectoryW.KERNEL32(0048A090,?,?,?,00000000), ref: 00442F6D
                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00442F75
                                                                                        • FindClose.KERNEL32(00000000), ref: 00442F80
                                                                                          • Part of subcall function 00436D2D: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75C83220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                        • FindClose.KERNEL32(00000000,?,?,?,00000000), ref: 00442F92
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                        • String ID: *.*
                                                                                        • API String ID: 2640511053-438819550
                                                                                        • Opcode ID: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                                                                                        • Instruction ID: 5fd3b3f399b1dfd6b0a62b5043663bf11a2259675d3c80dc16c90576bc2ddb84
                                                                                        • Opcode Fuzzy Hash: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                                                                                        • Instruction Fuzzy Hash: 0F41E8326083046BD620FA64DD85BEFB3A89BC5311F54492FF95483280E7FEA50D8779
                                                                                        Function 00444078 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Timetime$Sleep
                                                                                        • String ID: BUTTON
                                                                                        • API String ID: 4176159691-3405671355
                                                                                        • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                        • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                        • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                        • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                        Function 00434D50 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                        • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
                                                                                        • String ID: :$\$\??\%s
                                                                                        • API String ID: 3827137101-3457252023
                                                                                        • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                        • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                        • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                        • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                        Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                        • GetLastError.KERNEL32 ref: 00436504
                                                                                        • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                        • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                        • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                        • String ID: SeShutdownPrivilege
                                                                                        • API String ID: 2938487562-3733053543
                                                                                        • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                        • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                        • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                        • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                        Function 00445DD3 Relevance: 16.7, APIs: 11, Instructions: 179COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                          • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                          • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                        • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                        • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                        • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                        • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                        • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                        • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                        • String ID:
                                                                                        • API String ID: 1255039815-0
                                                                                        • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                        • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                        • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                        • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                        Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                        • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                        • GetLastError.KERNEL32 ref: 0045D59D
                                                                                        • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Error$Mode$DiskFreeLastSpace
                                                                                        • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                        • API String ID: 4194297153-14809454
                                                                                        • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                        • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                        • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                        • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                        Function 004037E0 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 359COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                        Strings
                                                                                        • Unterminated string, xrefs: 0042B9BA
                                                                                        • _, xrefs: 00403B48
                                                                                        • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                        • Error opening the file, xrefs: 0042B8AC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharCurrentDirectoryMultiWide$FullNamePath
                                                                                        • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                        • API String ID: 522955547-188983378
                                                                                        • Opcode ID: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                        • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                        • Opcode Fuzzy Hash: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                                        • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                        Function 0046F50B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 157nativewindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                          • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                        • ReleaseCapture.USER32 ref: 0046F589
                                                                                        • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                        • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AsyncState$CaptureClientCursorDialogMessageNtdllProc_ReleaseScreenSendTextWindow
                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                        • API String ID: 1737637668-2060113733
                                                                                        • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                        • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                        • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                        • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                        Function 0047A999 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                        • CLSIDFromProgID.COMBASE(00000000,?), ref: 0047AA27
                                                                                        • CoCreateInstance.COMBASE(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                        • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                        • CoCreateInstanceEx.COMBASE ref: 0047AD06
                                                                                        • CoSetProxyBlanket.COMBASE(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                        Strings
                                                                                        • NULL Pointer assignment, xrefs: 0047AD84
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
                                                                                        • String ID: NULL Pointer assignment
                                                                                        • API String ID: 628432406-2785691316
                                                                                        • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                        • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                        • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                        • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                        Function 0043614F Relevance: 12.1, APIs: 8, Instructions: 103COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                        • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                        • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                        • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                        • LockResource.KERNEL32(?), ref: 004361FD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Resource$FindLoadLock$Sizeof
                                                                                        • String ID:
                                                                                        • API String ID: 4215241788-0
                                                                                        • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                        • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                        • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                        • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                        Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MetricsSystem
                                                                                        • String ID:
                                                                                        • API String ID: 4116985748-0
                                                                                        • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                        • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                        • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                        • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                        Function 0047AD92 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                        • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                        • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                        • CLSIDFromProgID.COMBASE(00000000,?), ref: 0047AFCC
                                                                                        • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CopyVariant$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg
                                                                                        • String ID: HH
                                                                                        • API String ID: 3904779488-2761332787
                                                                                        • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                        • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                        • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                        • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                        Function 0044BD1F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139filestringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment Advice.exe,?,C:\Users\user\Desktop\Payment Advice.exe,004A8E80,C:\Users\user\Desktop\Payment Advice.exe,0040F3D2), ref: 0040FFCA
                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Find$AttributesCloseDeleteFirstFullMoveNamePathlstrcmpi
                                                                                        • String ID: \*.*
                                                                                        • API String ID: 557778909-1173974218
                                                                                        • Opcode ID: d788f72ee07323e66cd54f2957e2be6ab2a6e8a22d6ac24f33e2b000de170390
                                                                                        • Instruction ID: 95769b2cae527410a72ba1579a00ac0ee4a16eaedbb26c207e41b26dcd9c8430
                                                                                        • Opcode Fuzzy Hash: d788f72ee07323e66cd54f2957e2be6ab2a6e8a22d6ac24f33e2b000de170390
                                                                                        • Instruction Fuzzy Hash: AB5189B2408384AAD731DB60C885EDF73E89F85314F448D5FF69982141EB79D64CC7AA
                                                                                        Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • socket.WS2_32(00000002,00000001,00000006), ref: 004648B0
                                                                                        • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                        • bind.WS2_32(00000000,?,00000010), ref: 004648DA
                                                                                        • WSAGetLastError.WS2_32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                        • closesocket.WS2_32(00000000), ref: 0046492D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$bindclosesocketsocket
                                                                                        • String ID:
                                                                                        • API String ID: 2609815416-0
                                                                                        • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                        • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                        • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                        • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                        Function 00427859 Relevance: 9.5, Strings: 7, Instructions: 793COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?$T$_iB
                                                                                        • API String ID: 0-4145368158
                                                                                        • Opcode ID: 40fd759e06795c51c6d44f44d3c5b8b210a1b9c9a66bbae5e363e359e7067c76
                                                                                        • Instruction ID: 4c0c7ed0c9658f191bc49dc210f9e18f2f65a652a6defb2a8c1265378aa6e59e
                                                                                        • Opcode Fuzzy Hash: 40fd759e06795c51c6d44f44d3c5b8b210a1b9c9a66bbae5e363e359e7067c76
                                                                                        • Instruction Fuzzy Hash: A562C131E0466A8BDF24CFA8D8402EEB7B1FF55310F95816BD811AB381D7784A46CB99
                                                                                        Function 00426DA1 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00423462: SetFilePointer.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,0041BD80,00000000,00000000,00000000,00000002,00000000,00000000), ref: 004234A4
                                                                                          • Part of subcall function 00423462: GetLastError.KERNEL32(?,0041BD80,00000000,00000000,00000000,00000002,00000000,00000000,00000000,?,0041C46E,00000000,00000002,00000000,0048CB40,00000010), ref: 004234B1
                                                                                        • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,75C83140,00000109,00000000,?,?,0042598E,00000109,00000109), ref: 00426E0A
                                                                                        • RtlAllocateHeap.NTDLL(00000000), ref: 00426E11
                                                                                        • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75C83140,00000109,00000000,?,?,0042598E), ref: 00426E8D
                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,75C83140,00000109,00000000,?,?,0042598E,00000109), ref: 00426E94
                                                                                        • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75C83140,00000109,00000000,?,?,0042598E), ref: 00426EEF
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,75C83140,00000109,00000000,?,?,0042598E,00000109), ref: 00426F1C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Heap$ErrorFileLastProcess$AllocateFreePointer
                                                                                        • String ID:
                                                                                        • API String ID: 2677211326-0
                                                                                        • Opcode ID: c77f5c4fbdd969b6395b23d28f869cdae7d1fae00b5a1ae8a4ef132f81dfdc60
                                                                                        • Instruction ID: 42e05f79c57693437edf2df5a3fd70b8e7b48e5887b3da35eff89abe1339f9d1
                                                                                        • Opcode Fuzzy Hash: c77f5c4fbdd969b6395b23d28f869cdae7d1fae00b5a1ae8a4ef132f81dfdc60
                                                                                        • Instruction Fuzzy Hash: 8A410676A00125AEDF102FB8EC466AE7B75EF00324F57462AF934972A0D77C4D518B98
                                                                                        Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                        • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                        • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                        • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$File$CloseFirstNextSleep
                                                                                        • String ID: *.*
                                                                                        • API String ID: 1749430636-438819550
                                                                                        • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                        • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                        • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                        • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                        Function 00456354 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                        • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AsyncState$ClientCursorScreen
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 4210589936-2674840847
                                                                                        • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                        • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                        • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                        • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                        Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenClipboard.USER32(?), ref: 0046C635
                                                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                        • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                        • CloseClipboard.USER32 ref: 0046C65D
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                        • CloseClipboard.USER32 ref: 0046C692
                                                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                        • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                        • CloseClipboard.USER32 ref: 0046C866
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                        • String ID: HH
                                                                                        • API String ID: 589737431-2761332787
                                                                                        • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                        • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                        • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                        • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                        Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004647A2: inet_addr.WS2_32(?), ref: 004647C7
                                                                                        • socket.WS2_32(00000002,00000002,00000011), ref: 00474213
                                                                                        • WSAGetLastError.WS2_32(00000000), ref: 00474233
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastinet_addrsocket
                                                                                        • String ID:
                                                                                        • API String ID: 4170576061-0
                                                                                        • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                        • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                        • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                        • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                        Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetClientRect.USER32(?,?), ref: 00447997
                                                                                        • GetCursorPos.USER32(?), ref: 004479A2
                                                                                        • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                        • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000020,?,?), ref: 00447A78
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Client$CursorDialogFromNtdllPointProc_RectScreenWindow
                                                                                        • String ID:
                                                                                        • API String ID: 4176674648-0
                                                                                        • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                        • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                        • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                        • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                        Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windownativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCursorPos.USER32(?), ref: 004478A7
                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                        • GetCursorPos.USER32(?), ref: 00447935
                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CursorMenuPopupTrack$DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 192203443-0
                                                                                        • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                        • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                        • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                        • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                        Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                        • IsWindowVisible.USER32 ref: 00477314
                                                                                        • IsWindowEnabled.USER32 ref: 00477324
                                                                                        • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                        • IsIconic.USER32 ref: 0047733F
                                                                                        • IsZoomed.USER32 ref: 0047734D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                        • String ID:
                                                                                        • API String ID: 292994002-0
                                                                                        • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                        • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                        • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                        • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                        Function 00417D93 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                        • UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                        • GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                        • TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 2579439406-0
                                                                                        • Opcode ID: 1e849d302d6523c4eca3589611bb7f1730917824b3e599ff67baae63fbfc1711
                                                                                        • Instruction ID: 1e353620185c301eaa467651b296c472c2ab582025bec62c778f005c55eb3537
                                                                                        • Opcode Fuzzy Hash: 1e849d302d6523c4eca3589611bb7f1730917824b3e599ff67baae63fbfc1711
                                                                                        • Instruction Fuzzy Hash: 0A31D4B09013289BCB60DF65DD897C9BBB8AF18304F5045EEE50CA6251DBB85FC48F08
                                                                                        Function 004223BC Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004223F3
                                                                                        • GetCurrentProcessId.KERNEL32 ref: 004223FF
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00422407
                                                                                        • GetTickCount.KERNEL32 ref: 0042240F
                                                                                        • QueryPerformanceCounter.KERNEL32(?), ref: 0042241B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                        • String ID:
                                                                                        • API String ID: 1445889803-0
                                                                                        • Opcode ID: f5f58df8b3066ca0205ef19db65b763b05621757b61e1ba64a9c786d5d6483bf
                                                                                        • Instruction ID: fccd6c2f0e9de14ca193dd89c54efe282b2f985546ae9d4e91778ab0a4262a43
                                                                                        • Opcode Fuzzy Hash: f5f58df8b3066ca0205ef19db65b763b05621757b61e1ba64a9c786d5d6483bf
                                                                                        • Instruction Fuzzy Hash: 94115672E00124ABCB209BB4EE4855FB7F4FF58351F920976DD01E7210DAB49D00C798
                                                                                        Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75C83220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                        • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CloseCreateHandleTime
                                                                                        • String ID:
                                                                                        • API String ID: 3397143404-0
                                                                                        • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                        • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                        • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                        • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                        Function 0042039F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 282timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                          • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                          • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                          • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                          • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                        • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                          • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                          • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharExceptionFilterMultiProcessUnhandledWide$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone
                                                                                        • String ID: S\
                                                                                        • API String ID: 4226027050-393906132
                                                                                        • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                        • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                        • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                        • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                        Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetParent.USER32(?), ref: 004505BF
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_$Parent
                                                                                        • String ID:
                                                                                        • API String ID: 3146699748-0
                                                                                        • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                        • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                        • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                        • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                        Function 0043701F Relevance: 6.1, APIs: 4, Instructions: 76processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                        • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                        • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                        • String ID:
                                                                                        • API String ID: 420147892-0
                                                                                        • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                        • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                        • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                        • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                        Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                        • API String ID: 0-2165971703
                                                                                        • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                        • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                        • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                        • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                        Function 0044ED9A Relevance: 5.4, Strings: 4, Instructions: 448COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: DEFINE$`$h$h
                                                                                        • API String ID: 0-4194577831
                                                                                        • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                        • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                        • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                        • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                        Function 00436431 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: mouse_event
                                                                                        • String ID: DOWN
                                                                                        • API String ID: 2434400541-711622031
                                                                                        • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                        • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                        • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                        • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                        Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                        • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$File$CloseFirstNext
                                                                                        • String ID:
                                                                                        • API String ID: 3541575487-0
                                                                                        • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                        • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                        • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                        • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                        Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                        • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                        • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFind$AttributesCloseFirst
                                                                                        • String ID:
                                                                                        • API String ID: 48322524-0
                                                                                        • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                        • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                        • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                        • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                        Function 0044EBBC Relevance: 4.3, Strings: 3, Instructions: 551COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: ACCEPT$^$h
                                                                                        • API String ID: 0-4263704089
                                                                                        • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                        • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                        • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                        • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                        Function 0043323E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?), ref: 00433274
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3239928679-2674840847
                                                                                        • Opcode ID: 8985a75d1e5520d2e499eec1a241bc42e0f4e5500bc870e04c8b1cc553ee22c2
                                                                                        • Instruction ID: a483c428637070b8e8b58b13542464783085a457216f3b91bd99041a21057448
                                                                                        • Opcode Fuzzy Hash: 8985a75d1e5520d2e499eec1a241bc42e0f4e5500bc870e04c8b1cc553ee22c2
                                                                                        • Instruction Fuzzy Hash: C6E0EC71108230A6F2115B1D9C09FEFB798EB95711F00891AF595D50D1D7A89981C7A9
                                                                                        Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                        • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                        • String ID:
                                                                                        • API String ID: 901099227-0
                                                                                        • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                        • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                        • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                        • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                        Function 004230F5 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004231F1
                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 004231FE
                                                                                          • Part of subcall function 004180A7: GetModuleFileNameA.KERNEL32(00000000,00496789,00000104,?,00411739,?,00401C0B), ref: 0041814A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled$FileModuleName
                                                                                        • String ID:
                                                                                        • API String ID: 787209826-0
                                                                                        • Opcode ID: 1cbe704d86881204e8361e37842e1f13b131521e911a6f4d35389fdffc169e2d
                                                                                        • Instruction ID: 9d34c63210c516c804ddbcbce3c521aa4eb8bf6faa5e2c9a58dfeebf86138d69
                                                                                        • Opcode Fuzzy Hash: 1cbe704d86881204e8361e37842e1f13b131521e911a6f4d35389fdffc169e2d
                                                                                        • Instruction Fuzzy Hash: 2C21E67091132D9ACB21EF659D897C9BBB8AF18704F1040EBA50CA6261DB789FC58F58
                                                                                        Function 00469995 Relevance: 3.1, APIs: 2, Instructions: 62nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000114,00000000,?,?,?,?,?,004A83D8,?), ref: 00469A31
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: dc39a28d6584410e7e9d39be8fdef0c21f65586a3d31f41dfecdd17b11510ed2
                                                                                        • Instruction ID: 5414628f158ba78a046d4a24b655e4ccbf4c8d46c3d310d0e0a8d963d1b880b8
                                                                                        • Opcode Fuzzy Hash: dc39a28d6584410e7e9d39be8fdef0c21f65586a3d31f41dfecdd17b11510ed2
                                                                                        • Instruction Fuzzy Hash: B4115932700150ABE610CA59EC44E7BB79DEBCA725F14815FF68093282DBB96C05D77B
                                                                                        Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                        • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$CloseFileFirst
                                                                                        • String ID:
                                                                                        • API String ID: 2295610775-0
                                                                                        • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                        • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                        • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                        • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                        Function 00447A87 Relevance: 3.1, APIs: 2, Instructions: 53nativewindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00447AE5
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,004A83D8,?), ref: 00447B09
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogMessageNtdllProc_Send
                                                                                        • String ID:
                                                                                        • API String ID: 3814093946-0
                                                                                        • Opcode ID: 282f86207f84fb720c1c146b20eb36cb5bd987ddbd5c6a609029bff053d642d3
                                                                                        • Instruction ID: cf0c3d739a266ecf9dfb39524e393d8b6385858120b34e0c7784725de632f42e
                                                                                        • Opcode Fuzzy Hash: 282f86207f84fb720c1c146b20eb36cb5bd987ddbd5c6a609029bff053d642d3
                                                                                        • Instruction Fuzzy Hash: 8F01DB323002509BD320DF48D888F6BB769EBDA725F14492EFA409B280C7B5B806C775
                                                                                        Function 00461EB0 Relevance: 3.0, APIs: 2, Instructions: 48nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                          • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000201,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 00461F01
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000204,?,00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 00461F21
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AsyncDialogNtdllProc_State$ClientCursorScreen
                                                                                        • String ID:
                                                                                        • API String ID: 2121657457-0
                                                                                        • Opcode ID: a8825b0a69f284e0c5f8ab03e6ab6924ca40bb3ee268c2d78caca0fc9fe2bfa7
                                                                                        • Instruction ID: 18d9c50e6c24968168519bdb59aa32127fc81338cec1df6736236d991af0d7d7
                                                                                        • Opcode Fuzzy Hash: a8825b0a69f284e0c5f8ab03e6ab6924ca40bb3ee268c2d78caca0fc9fe2bfa7
                                                                                        • Instruction Fuzzy Hash: 1C01A272201320ABE6149A4A9C59D7BB3ACEBCA712F04481FF64193192C7B96810C779
                                                                                        Function 004331D9 Relevance: 3.0, APIs: 2, Instructions: 35nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ClientToScreen.USER32(?,?), ref: 00433202
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000200,?), ref: 0043322F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClientDialogNtdllProc_Screen
                                                                                        • String ID:
                                                                                        • API String ID: 3420055661-0
                                                                                        • Opcode ID: 8e2001f9d1191b047fdc261eecd0625cae7c1ad5e6a69bec7795623591e4d7bc
                                                                                        • Instruction ID: 79334b24f5e752891c7b85279833e8fa03bb884f24ead4a413b07d40b8d8150b
                                                                                        • Opcode Fuzzy Hash: 8e2001f9d1191b047fdc261eecd0625cae7c1ad5e6a69bec7795623591e4d7bc
                                                                                        • Instruction Fuzzy Hash: 22F0F4B6504311AFE200DF05ED8492BB7E8EBC8712F148D2EF99193251C7B4A909DBB6
                                                                                        Function 0044AF5C Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(00000000,00000000,00000FFF,00000000,?,?,004782E6,?,?,?), ref: 0044AF8E
                                                                                        • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,00000000,00000FFF,00000000,?,?,004782E6,?,?,?), ref: 0044AFA5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFormatLastMessage
                                                                                        • String ID:
                                                                                        • API String ID: 3479602957-0
                                                                                        • Opcode ID: 265d7a19d3eba539260361cc1fe5a3e70b302e1c8fb97200548962176bc833fd
                                                                                        • Instruction ID: 470e8fa0199c65dedc5e4648daea85b25893cba94944c51086ff1a152fa8b7f9
                                                                                        • Opcode Fuzzy Hash: 265d7a19d3eba539260361cc1fe5a3e70b302e1c8fb97200548962176bc833fd
                                                                                        • Instruction Fuzzy Hash: 0EF082712543416BF324E764DC49FBBB3A8EF84715F008E2EF155960E1D7B4A848C76A
                                                                                        Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 0vH$HH
                                                                                        • API String ID: 0-728391547
                                                                                        • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                        • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                        • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                        • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                        Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                        • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                        • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                        • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                        Function 00427161 Relevance: 1.9, Strings: 1, Instructions: 608COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 3gB
                                                                                        • API String ID: 0-1795317511
                                                                                        • Opcode ID: 6da754253abd2e35eb2e5a274ee4f9ff3dc2e5057a81817226e1356d575d6b11
                                                                                        • Instruction ID: 325a13a96c06d4c98cee853255adfbe26994b6972aee23e03a37be849d38a260
                                                                                        • Opcode Fuzzy Hash: 6da754253abd2e35eb2e5a274ee4f9ff3dc2e5057a81817226e1356d575d6b11
                                                                                        • Instruction Fuzzy Hash: 25228B31E08229CBDF24CFA8E4503EDBBB1FB55314FA4816BD841AB385D7785882DB59
                                                                                        Function 00423EBF Relevance: 1.8, Strings: 1, Instructions: 518COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID: 0-3916222277
                                                                                        • Opcode ID: 6f06e7075314c4b5cd3cd4e20df4d655c17907c29f2ec2607831f9469bb2a80c
                                                                                        • Instruction ID: 7ade078c4ceb211684f0ec6d2ad2e22094a4d55ff3f4f285c4f8e3fdcd89c172
                                                                                        • Opcode Fuzzy Hash: 6f06e7075314c4b5cd3cd4e20df4d655c17907c29f2ec2607831f9469bb2a80c
                                                                                        • Instruction Fuzzy Hash: 7E02F932F105299BDF04CF68E8403ADB3B2FBD8355F65826EDD26A7290C7746A45CB84
                                                                                        Function 0041D750 Relevance: 1.8, APIs: 1, Instructions: 266COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RaiseException.KERNEL32(?,00000000,00000001,?,00000000,0000FFFF,?,?,0041DA4A,?,?,?,?,?,0041DDE3,00000000), ref: 0041D974
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionRaise
                                                                                        • String ID:
                                                                                        • API String ID: 3997070919-0
                                                                                        • Opcode ID: 3e752bb449efab522d3200141cf3dcee0c6bb4a1b97e107f9c0d62f6c5d4ee43
                                                                                        • Instruction ID: 72ef4f9e9c7a35c4269090967bf6b9d23df6b64c3bcfe04dbdb27e9d628d6ebd
                                                                                        • Opcode Fuzzy Hash: 3e752bb449efab522d3200141cf3dcee0c6bb4a1b97e107f9c0d62f6c5d4ee43
                                                                                        • Instruction Fuzzy Hash: D0B191B1A10609CFDB18DF18C496AA67BE0FF44354F19865EE99A8F3E1C738D981CB44
                                                                                        Function 00454C69 Relevance: 1.6, APIs: 1, Instructions: 73nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000112,?,?,004A83D8,?), ref: 00454D46
                                                                                          • Part of subcall function 0044A37A: GetForegroundWindow.USER32(?,?,00454CBD,004A83D8,000000FC,00000000,?,?,004A83D8,?), ref: 0044A37C
                                                                                          • Part of subcall function 0044A37A: GetFocus.USER32 ref: 0044A384
                                                                                          • Part of subcall function 0044A37A: SendMessageW.USER32(?,000000B0,-000001B0,000001B4), ref: 0044A3F6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogFocusForegroundMessageNtdllProc_SendWindow
                                                                                        • String ID:
                                                                                        • API String ID: 3709282597-0
                                                                                        • Opcode ID: 38e5b937cba7a8922a2e949dccea1575aba6194ef8ab83a07684414c46f4c513
                                                                                        • Instruction ID: a6609401f9500212a734e1352de4f41152f1c619293fb73b243e796064327410
                                                                                        • Opcode Fuzzy Hash: 38e5b937cba7a8922a2e949dccea1575aba6194ef8ab83a07684414c46f4c513
                                                                                        • Instruction Fuzzy Hash: 4421543020831565F6205258CC06F7B2668CBD2F2AF340A2FFC10A92D7C9EC6CDC922E
                                                                                        Function 00440ADF Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,004A83D8,?), ref: 00440B2E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 0350c70204df7ca237879bf3e5fe06d0c1427b15f4b1adfefff728055112d21b
                                                                                        • Instruction ID: 2f89758668ff77fbe337a6258bca86c2c54edd6c60dd2fee594f13a620ab578e
                                                                                        • Opcode Fuzzy Hash: 0350c70204df7ca237879bf3e5fe06d0c1427b15f4b1adfefff728055112d21b
                                                                                        • Instruction Fuzzy Hash: 14F0E9716002119BE210CF04D80092B7BB5EBCA725F10851EF95157291C774AC52C7F9
                                                                                        Function 0044099C Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,00000028), ref: 004409D5
                                                                                          • Part of subcall function 00433FA4: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004A9300,004A92EC), ref: 00433FFF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateDialogNtdllProc_Process
                                                                                        • String ID:
                                                                                        • API String ID: 335295663-0
                                                                                        • Opcode ID: e47f80020b222bd5a26384a14466514d1d96ec9df3e7169497835d57343bbae6
                                                                                        • Instruction ID: c9e79bee830d5b1130f852bdf2201be18db1474156fe398ae3ca2d8ebb21299f
                                                                                        • Opcode Fuzzy Hash: e47f80020b222bd5a26384a14466514d1d96ec9df3e7169497835d57343bbae6
                                                                                        • Instruction Fuzzy Hash: 7DE039B5608210AFD600EF44E990C9BB3A8EFCD314F01880DF98197256C734ED51CB65
                                                                                        Function 00454C1B Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 00454C5F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 4a9068e34db6673d47e394aa80019476632bd9475fd7ea27e6bfec8fc14f2c8f
                                                                                        • Instruction ID: 0c4b3b86ab389f7a39b655bf95fc8aee58d6d74e14bbd2e4030a53327a1dd945
                                                                                        • Opcode Fuzzy Hash: 4a9068e34db6673d47e394aa80019476632bd9475fd7ea27e6bfec8fc14f2c8f
                                                                                        • Instruction Fuzzy Hash: 7EF03074248310AFE210DB54DC49F97B7A4DBC9715F20494DB859572D18AB46C44CB65
                                                                                        Function 0044782B Relevance: 1.5, APIs: 1, Instructions: 22nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,0000031A,?,?,?), ref: 00447863
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 18858d74dfa023294b40976d9944400fc0d5ac482db733d0de99421c67fed763
                                                                                        • Instruction ID: 42e261f6b1c5cc74ba357aecf8ff1bc27c413e858a44b620ffcb460ef2ec5e49
                                                                                        • Opcode Fuzzy Hash: 18858d74dfa023294b40976d9944400fc0d5ac482db733d0de99421c67fed763
                                                                                        • Instruction Fuzzy Hash: E1E012B5915310AFD700EF64AD559AFB7E8EFD8710F008C2EF84593241D634A9048BA6
                                                                                        Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • BlockInput.USER32(00000001), ref: 0045A272
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BlockInput
                                                                                        • String ID:
                                                                                        • API String ID: 3456056419-0
                                                                                        • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                        • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                        • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                        • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                        Function 00447B15 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,004A83D8,?), ref: 00447B44
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 0cfbf2acc00addbbb112fedb16ead420504d194982c0b609c4a8b51bc51d211d
                                                                                        • Instruction ID: 287779551a3d337ef591f2aa8d6aea7dae02fb3ffa9334f78727036f59ac8bdc
                                                                                        • Opcode Fuzzy Hash: 0cfbf2acc00addbbb112fedb16ead420504d194982c0b609c4a8b51bc51d211d
                                                                                        • Instruction Fuzzy Hash: 1EE08C75341210FFD610EB44CC45EABB768EFCA710F20884DB6409B291CAB5B882CBA9
                                                                                        Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: LogonUser
                                                                                        • String ID:
                                                                                        • API String ID: 1244722697-0
                                                                                        • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                        • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                        • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                        • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                        Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: NameUser
                                                                                        • String ID:
                                                                                        • API String ID: 2645101109-0
                                                                                        • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                        • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                        • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                        • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                        Function 0046F749 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0046EA7F: DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,004A83D8,?), ref: 0046F766
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AcceleratorDestroyDialogNtdllProc_Table
                                                                                        • String ID:
                                                                                        • API String ID: 2638641937-0
                                                                                        • Opcode ID: 06952883360e1e391e59db4eaed395cda2773b78a7793c669c636c8e584b7d12
                                                                                        • Instruction ID: 06d0bebe78a134197a7dbf98cf3f66dff11b544ea33b26a74c1067ac85f7c233
                                                                                        • Opcode Fuzzy Hash: 06952883360e1e391e59db4eaed395cda2773b78a7793c669c636c8e584b7d12
                                                                                        • Instruction Fuzzy Hash: 6AC0127528132071D42072655C0BFCF65589F95B10F10880EB704760D145F8684046AE
                                                                                        Function 0044096A Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000211), ref: 00440993
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 41a03df81dd0099e64b80ded503388aed7d4d67559f9716f09430e6844efc855
                                                                                        • Instruction ID: 407f05fc3492abb5fd49a85034767b6ec1f65670c295c667e1fd20220c9b2f04
                                                                                        • Opcode Fuzzy Hash: 41a03df81dd0099e64b80ded503388aed7d4d67559f9716f09430e6844efc855
                                                                                        • Instruction Fuzzy Hash: A4E0BD78204241AFC700DF04C8A8E5AB7A5EB89300F05885CF695873A1C7B0A810CB61
                                                                                        Function 00440938 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • NtdllDialogWndProc_W.NTDLL(?,00000212), ref: 00440961
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DialogNtdllProc_
                                                                                        • String ID:
                                                                                        • API String ID: 3239928679-0
                                                                                        • Opcode ID: 9007b3aeaa96a9216af1aa891557632efc81bced1778891bc28c6ea784fb7703
                                                                                        • Instruction ID: 61be733c19743c94c30739cd10f0c63b75a633f5031b8889380e421685ee7e99
                                                                                        • Opcode Fuzzy Hash: 9007b3aeaa96a9216af1aa891557632efc81bced1778891bc28c6ea784fb7703
                                                                                        • Instruction Fuzzy Hash: 75E0BD78204241AFC300DF04C9A8E5AB7A5EB89300F05885CFA95873A6C7B0A814CB21
                                                                                        Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                        • String ID:
                                                                                        • API String ID: 3192549508-0
                                                                                        • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                        • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                        • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                        • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                        Function 00443390 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Time$FileSystem
                                                                                        • String ID: rJ
                                                                                        • API String ID: 2086374402-1865492326
                                                                                        • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                        • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                        • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                        • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                        Function 00443391 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Time$FileSystem
                                                                                        • String ID: rJ
                                                                                        • API String ID: 2086374402-1865492326
                                                                                        • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                        • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                        • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                        • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                        Function 0041AF0D Relevance: .6, Instructions: 614COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 354bb9de70e7a0ca26fca200091f338a73f7d95ac473b9620ece626005e4d916
                                                                                        • Instruction ID: b7b23f85eb0a2e5ca54dc3c755d87eb57e1e2ec4f7ab1faed5db49ee01a7315b
                                                                                        • Opcode Fuzzy Hash: 354bb9de70e7a0ca26fca200091f338a73f7d95ac473b9620ece626005e4d916
                                                                                        • Instruction Fuzzy Hash: 17328C71D002198FDF24CFA8C4542EEBBB2FF58715F64812BD852AB284D77848C6CB89
                                                                                        Function 0040F890 Relevance: .6, Instructions: 589COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                        • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                        • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                        • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                        Function 00411B63 Relevance: .5, Instructions: 528COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8a3d5087dd20accb23969c3925dc540b0c919307cd436b6fa687a31edc4bc05f
                                                                                        • Instruction ID: 587d2ccb264c520bda6fdd860f1d97339e5d8a8ab0720f255f163f1264fae3dc
                                                                                        • Opcode Fuzzy Hash: 8a3d5087dd20accb23969c3925dc540b0c919307cd436b6fa687a31edc4bc05f
                                                                                        • Instruction Fuzzy Hash: 7F02D133D497B34B8B314EF941E01A77EA05E0569130F47EADEC06F396C21ADD9A86E4
                                                                                        Function 0042397B Relevance: .5, Instructions: 518COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: ea7ecdee6ac2e72654eecb9430e4f352bbd77c369f68d58dc27da5fc62acdc79
                                                                                        • Instruction ID: 9e35f59c0add5ef17a89191b59ea5f5d96c4811c663926068cb485e9fd62b85b
                                                                                        • Opcode Fuzzy Hash: ea7ecdee6ac2e72654eecb9430e4f352bbd77c369f68d58dc27da5fc62acdc79
                                                                                        • Instruction Fuzzy Hash: 6802E932B105299BDF04CF69D4403ADB7B2FBD8316F65C67ED916A7290C3786A05CB84
                                                                                        Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                        • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                        • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                        • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                        Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                        • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                        • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                        • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                        Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                        • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                        • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                        • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                        Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                        • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                        • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                        • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                        Function 004212BE Relevance: .3, Instructions: 336COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c47d925e012dda58e8a2147bbcbf95fd97a699f804f8c671293b5c898a81ed87
                                                                                        • Instruction ID: edaac073b8829911ee68c4be0bcacd547f0c6bb47cd210bca20706155a8c2891
                                                                                        • Opcode Fuzzy Hash: c47d925e012dda58e8a2147bbcbf95fd97a699f804f8c671293b5c898a81ed87
                                                                                        • Instruction Fuzzy Hash: 19A1E571700571BBDB259F19A84457F73A2ABE8340BE90897E417DB230D639DC8286DE
                                                                                        Function 0041A46B Relevance: .3, Instructions: 256COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
                                                                                        • Instruction ID: a9eacd5bf21785df47d5f6a8feadd8f5aba99018e25b90ef92f88a0652348d6e
                                                                                        • Opcode Fuzzy Hash: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
                                                                                        • Instruction Fuzzy Hash: 4EB17C75901206DFCB15CF04C5D0AE8BBA2BF58318F18C1AED85A5B382D735EE96CB94
                                                                                        Function 00424F70 Relevance: .2, Instructions: 179COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: e05110175a02ad8a98d0b88426b8237eabc330e871628757fc1341c999dc4983
                                                                                        • Instruction ID: 27c0ed5615e67d41993455ad039feeb87c327f1bdc276cc3fba1b84fa5168a92
                                                                                        • Opcode Fuzzy Hash: e05110175a02ad8a98d0b88426b8237eabc330e871628757fc1341c999dc4983
                                                                                        • Instruction Fuzzy Hash: 03619E71A016228FCB18CF49D8949AAF7B2FF89300B5AC16EC9096B362C7749D41CBC4
                                                                                        Function 044F3658 Relevance: .1, Instructions: 92COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                        • Instruction ID: 2a1b09831a221bd34043d46a61109e17d484446340a8e817c7038fada372aaef
                                                                                        • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                        • Instruction Fuzzy Hash: 2141D371D1051CEBDF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80
                                                                                        Function 044F3548 Relevance: .0, Instructions: 35COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                        • Instruction ID: 2a702da6b65b6d880b0644a1b195fe50ab06ba47e1361425872f9672f93ac1ae
                                                                                        • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                        • Instruction Fuzzy Hash: 78019278A11209EFCB44DF98C5909AEF7B5FB88310F20859ADD19A7301D730BE41DB80
                                                                                        Function 044F34E8 Relevance: .0, Instructions: 35COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                        • Instruction ID: 3252c7a35e32192ba3e8775b10a50058b6efc46b81b40c7a577aeb7afba0885b
                                                                                        • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                        • Instruction Fuzzy Hash: 51014078A01209EFCB58DF99C5909AEF7B5FB88210F20859ADD19A7745D730BE41DB80
                                                                                        Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                        • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                        • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                        • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                        Function 044F1EB8 Relevance: .0, Instructions: 6COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71530529699.00000000044F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044F0000, based on PE: false
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_44f0000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                        • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                        • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                        • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                        Function 00459384 Relevance: 68.7, APIs: 35, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteObject.GDI32(?), ref: 004593D7
                                                                                        • DeleteObject.GDI32(?), ref: 004593F1
                                                                                        • GetDesktopWindow.USER32 ref: 0045942A
                                                                                        • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                        • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                        • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                        • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                        • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                        • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00459694
                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                        • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                        • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                        • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                        • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                        • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                        • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                        • 744DA3B0.USER32(?,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598DE
                                                                                        • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                        • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                        • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                        • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$CreateObject$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocClientCloseCopyDesktopFaceFontFreeHandleImageLoadLockMovePictureReadSizeStockStreamTextUnlock
                                                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                                                        • API String ID: 565491340-2373415609
                                                                                        • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                        • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                        • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                        • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                        Function 00441E05 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 276COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSysColor.USER32(00000012), ref: 00441E64
                                                                                        • SetTextColor.GDI32(?,?), ref: 00441E6C
                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                                                                                        • GetSysColor.USER32(0000000F), ref: 00441E8F
                                                                                        • SetBkColor.GDI32(?,?), ref: 00441EAA
                                                                                        • SelectObject.GDI32(?,?), ref: 00441EBA
                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                                                                                        • GetSysColor.USER32(00000010), ref: 00441EF8
                                                                                        • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                                                                                        • FrameRect.USER32(?,?,00000000), ref: 00441F10
                                                                                        • DeleteObject.GDI32(?), ref: 00441F1B
                                                                                        • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                                                                                        • FillRect.USER32(?,?,?), ref: 00441FB6
                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                          • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                          • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                          • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                          • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                          • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                          • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                                                                          • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                          • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                          • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameMessageRoundSendSolid
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3518701105-2674840847
                                                                                        • Opcode ID: d218d880d346c1ecbf0f5b9b78a982ad3551f5cf8a2409a8dc6e180da7254fc7
                                                                                        • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                                                                                        • Opcode Fuzzy Hash: d218d880d346c1ecbf0f5b9b78a982ad3551f5cf8a2409a8dc6e180da7254fc7
                                                                                        • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                                                                                        Function 00433D5C Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 198windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                        • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                        • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                        • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                        • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                        • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                        • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                        • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                        • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                        • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                        • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                        • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                        • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                        • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                        • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                        • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                        • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                        • DeleteObject.GDI32(?), ref: 00433F70
                                                                                        • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                        • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                        • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                        • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflate$FocusMessageRoundSendSolidWindow
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 1441705042-2674840847
                                                                                        • Opcode ID: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                        • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                        • Opcode Fuzzy Hash: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                                        • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                        Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenClipboard.USER32(?), ref: 0046C635
                                                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                        • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                        • CloseClipboard.USER32 ref: 0046C65D
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                        • CloseClipboard.USER32 ref: 0046C692
                                                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                        • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                        • CloseClipboard.USER32 ref: 0046C866
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                        • String ID: HH
                                                                                        • API String ID: 589737431-2761332787
                                                                                        • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                        • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                        • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                        • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                        Function 0045657D Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 287windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCursorPos.USER32(?), ref: 00456692
                                                                                        • GetDesktopWindow.USER32 ref: 004566AA
                                                                                        • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                        • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                        • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                        • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                        • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                        • IsWindowVisible.USER32(?), ref: 00456812
                                                                                        • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                        • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                        • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                        • GetMonitorInfoW.USER32 ref: 00456894
                                                                                        • CopyRect.USER32(?,?), ref: 004568A8
                                                                                        • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Window$Rect$Monitor$CopyCreateCursorDesktopFromInfoPointVisible
                                                                                        • String ID: ($,$0DNt$tooltips_class32
                                                                                        • API String ID: 250492556-1271729840
                                                                                        • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                        • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                        • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                        • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                        Function 004559A8 Relevance: 33.7, APIs: 17, Strings: 2, Instructions: 401COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 0$0DNt
                                                                                        • API String ID: 0-1070802393
                                                                                        • Opcode ID: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                        • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                        • Opcode Fuzzy Hash: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                                        • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                        Function 00448759 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 311COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window
                                                                                        • String ID: 0$0DNt
                                                                                        • API String ID: 2353593579-1070802393
                                                                                        • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                        • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                        • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                        • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                        Function 004700B0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                        • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                        • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                        • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                        • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                        • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                        • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                        • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                        • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                        • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                        • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                        • GetClientRect.USER32(?,?), ref: 00470371
                                                                                        • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                        • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                        • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateMessageObjectSendStockTimer
                                                                                        • String ID: AutoIt v3 GUI
                                                                                        • API String ID: 3237284469-248962490
                                                                                        • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                        • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                        • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                        • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                        Function 0044A0EA Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 196windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSysColor.USER32 ref: 0044A11D
                                                                                        • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                        • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                        • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                        • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                        • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                        • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                        • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Color$Pixel$ClientMessageModeObjectRectSendStockText
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 4000845554-2674840847
                                                                                        • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                        • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                        • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                        • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                        Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: InitVariant
                                                                                        • String ID:
                                                                                        • API String ID: 1927566239-0
                                                                                        • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                        • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                        • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                        • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                        Function 0046AEAF Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 417registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AFC2
                                                                                        • RegCreateKeyExW.ADVAPI32(?,?,00000000,004848E8,00000000,?,00000000,?,?,?,?,?), ref: 0046B01C
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 0046B069
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseConnectCreateRegistry
                                                                                        • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                        • API String ID: 3217815495-966354055
                                                                                        • Opcode ID: 732a809445d423313388e5f08cb9df37ac73e1fa509303b801a12c02435c01dd
                                                                                        • Instruction ID: d9d2404220d166b11353d33fb52652cf6d28829cdaa3b272cf204d1a2c990fb8
                                                                                        • Opcode Fuzzy Hash: 732a809445d423313388e5f08cb9df37ac73e1fa509303b801a12c02435c01dd
                                                                                        • Instruction Fuzzy Hash: 2CE1A1B1600300ABD710EF65C885F1BB7E8AF48704F14895EB945DB392D778E945CBAA
                                                                                        Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                        • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                        • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                        • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                        • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                        • GetDesktopWindow.USER32 ref: 00454708
                                                                                        • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                        • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                        • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                        • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                        • String ID:
                                                                                        • API String ID: 3869813825-0
                                                                                        • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                        • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                        • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                        • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                        Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                        • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                        • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                        • GetCursorInfo.USER32 ref: 00458E03
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Cursor$Load$Info
                                                                                        • String ID:
                                                                                        • API String ID: 2577412497-0
                                                                                        • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                        • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                        • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                        • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                        Function 0046D6EB Relevance: 25.0, APIs: 5, Strings: 9, Instructions: 474COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                        • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                        • IsWindow.USER32(?), ref: 0046DBDE
                                                                                        • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                        • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Foreground$DesktopEnumWindows
                                                                                        • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                        • API String ID: 2615144819-1919597938
                                                                                        • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                        • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                        • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                        • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                        Function 00454DAA Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                        • DestroyCursor.USER32(?), ref: 00454FA2
                                                                                        • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                        • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow
                                                                                        • String ID: .dll$.exe$.icl
                                                                                        • API String ID: 1851087544-1154884017
                                                                                        • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                        • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                        • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                        • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                        Function 0046F90E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 147windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                        • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                        • DeleteObject.GDI32(?), ref: 0046F950
                                                                                        • DestroyCursor.USER32(?), ref: 0046F95E
                                                                                        • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                        • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                        • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                        • DestroyCursor.USER32(?), ref: 0046F9DD
                                                                                        • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                        • DestroyCursor.USER32(?), ref: 0046FA4F
                                                                                        • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                        • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                        • DestroyCursor.USER32(?), ref: 0046FA76
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CursorDestroy$DeleteMessageObjectSend$ImageLoad$ExtractIcon
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3924271234-2674840847
                                                                                        • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                        • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                        • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                        • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                        Function 004680EB Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 204windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                        • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                        • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                        • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                        • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                        • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                        • GetMenuItemCount.USER32 ref: 004682DC
                                                                                        • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                        • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                        • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                        • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                        • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                                                                                        • String ID: 0
                                                                                        • API String ID: 1441871840-4108050209
                                                                                        • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                        • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                        • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                        • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                        Function 00416E29 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloadermemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00416E33
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00416E5A
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00416E67
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00416E74
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00416E81
                                                                                        • TlsAlloc.KERNEL32 ref: 00416ED1
                                                                                        • TlsSetValue.KERNEL32(00000000), ref: 00416EEC
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00416F9B
                                                                                          • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                          • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                          • Part of subcall function 00416AD5: TlsFree.KERNEL32(00000017,00416FB1), ref: 00416B00
                                                                                          • Part of subcall function 00416AD5: RtlDeleteCriticalSection.NTDLL(00000000), ref: 004182F3
                                                                                          • Part of subcall function 00416AD5: RtlDeleteCriticalSection.NTDLL(00000017), ref: 0041831D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$CriticalDeleteHandleModuleSection$AllocCurrentFreeSleepThreadValue
                                                                                        • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                        • API String ID: 3695068788-3819984048
                                                                                        • Opcode ID: 660662fe562bd5df9e71747b560807e073ce05f8452fe62a28632ef6bbcc4d49
                                                                                        • Instruction ID: 1ebf73b64dbffc71e92b2f6362eaf19a7a9985e6bf90978250493e6b1e67b5cd
                                                                                        • Opcode Fuzzy Hash: 660662fe562bd5df9e71747b560807e073ce05f8452fe62a28632ef6bbcc4d49
                                                                                        • Instruction Fuzzy Hash: 7A312F719003109BCB21AFB5ED45A8A3EE4EB24758717097FF814922B5DB7DC4828F9C
                                                                                        Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                        • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CursorLoad
                                                                                        • String ID:
                                                                                        • API String ID: 3238433803-0
                                                                                        • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                        • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                        • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                        • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                        Function 0045F48E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                        • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                        • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: InfoItemMenu$Sleep
                                                                                        • String ID: 0
                                                                                        • API String ID: 1196289194-4108050209
                                                                                        • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                        • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                        • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                        • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                        Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • StringFromCLSID.COMBASE(?,?), ref: 0047D6B5
                                                                                        • CoTaskMemFree.COMBASE(?), ref: 0047D6D3
                                                                                        • StringFromIID.COMBASE(?,?), ref: 0047D7F0
                                                                                        • CoTaskMemFree.COMBASE(?), ref: 0047D80A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeFromStringTask
                                                                                        • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                        • API String ID: 910554386-934586222
                                                                                        • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                        • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                        • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                        • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                        Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                        • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: SendString$BuffCharDriveLowerType
                                                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                        • API String ID: 1600147383-4113822522
                                                                                        • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                        • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                        • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                        • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                        Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0043354F
                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                        • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                        • DeleteObject.GDI32(?), ref: 00433603
                                                                                        • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                        • String ID:
                                                                                        • API String ID: 3969911579-0
                                                                                        • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                        • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                        • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                        • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                        Function 0045EEFF Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 74COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0045EF6C
                                                                                        • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045EF81
                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045EF94
                                                                                        • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0045EFAB
                                                                                        • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045EFB8
                                                                                        • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0045EFD2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: SendString
                                                                                        • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                        • API String ID: 890592661-1007645807
                                                                                        • Opcode ID: 2e8e49e05c1f121906b47c7a82fbb4c843ecfb9788746b18ac8014d8855edcbb
                                                                                        • Instruction ID: e5e6e3524f15ee9b53aa238c1547bf14c0af5fa70a1fb0ad50a0449216793e57
                                                                                        • Opcode Fuzzy Hash: 2e8e49e05c1f121906b47c7a82fbb4c843ecfb9788746b18ac8014d8855edcbb
                                                                                        • Instruction Fuzzy Hash: F321A53164830476E220FB51DC87F9E7798AB84B14F200D3BBA407A0D1DBA8E94CC76E
                                                                                        Function 004556F8 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 216COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateWindow
                                                                                        • String ID: ,$tooltips_class32
                                                                                        • API String ID: 716092398-3856767331
                                                                                        • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                        • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                        • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                        • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                        Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • StringFromIID.COMBASE(?,?), ref: 004582E5
                                                                                        • CoTaskMemFree.COMBASE(?), ref: 00458335
                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                        • CLSIDFromString.COMBASE(00000000,?), ref: 004583AF
                                                                                        • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                        • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType
                                                                                        • String ID: Version$\TypeLib$interface\
                                                                                        • API String ID: 3215668907-939221531
                                                                                        • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                        • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                        • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                        • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                        Function 0045510D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 115windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                        • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                        • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                        • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                        • DrawMenuBar.USER32 ref: 00455207
                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                        • DestroyCursor.USER32(?), ref: 0045566A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$Delete$DestroyItemObject$CountCursorDrawInfo
                                                                                        • String ID: 0
                                                                                        • API String ID: 3807689593-4108050209
                                                                                        • Opcode ID: 5de293071bfa77a69a20994f6fddbd53bc756fd48e41a9514c07dc4157a085c8
                                                                                        • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                        • Opcode Fuzzy Hash: 5de293071bfa77a69a20994f6fddbd53bc756fd48e41a9514c07dc4157a085c8
                                                                                        • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                        Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                        • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                        • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                        • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                        • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CharNext
                                                                                        • String ID:
                                                                                        • API String ID: 1350042424-0
                                                                                        • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                        • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                        • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                        • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                        Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                        • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                        • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                        • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                        • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                        • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                        • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: State$Async$Keyboard
                                                                                        • String ID:
                                                                                        • API String ID: 541375521-0
                                                                                        • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                        • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                        • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                        • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                        Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                        • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                        • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                        • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                        • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                                                        • String ID:
                                                                                        • API String ID: 3096461208-0
                                                                                        • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                        • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                        • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                        • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                        Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConnectRegistry
                                                                                        • String ID: HH
                                                                                        • API String ID: 76216097-2761332787
                                                                                        • Opcode ID: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                        • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                        • Opcode Fuzzy Hash: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                                        • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                        Function 00460ABB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                        • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                        • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                        • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                        • GetParent.USER32(?), ref: 00460D40
                                                                                        • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                                                        • String ID: %s%u
                                                                                        • API String ID: 1412819556-679674701
                                                                                        • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                        • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                        • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                        • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                        Function 00475D8B Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 194COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                        • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BuffCharDriveLowerType
                                                                                        • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                        • API String ID: 2426244813-4176887700
                                                                                        • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                        • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                        • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                        • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                        Function 0045DE12 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 190timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(?), ref: 0045DED4
                                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
                                                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CurrentDirectory$Time$File$Local$System
                                                                                        • String ID: *.*
                                                                                        • API String ID: 1599115645-438819550
                                                                                        • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                        • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
                                                                                        • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                        • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
                                                                                        Function 004480F2 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                        • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                        • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                        • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                        • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                        • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                        • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3850602802-2674840847
                                                                                        • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                        • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                        • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                        • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                        Function 004580E1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                        • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                        • CLSIDFromString.COMBASE(00000000,?), ref: 00458279
                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                        • API String ID: 3030280669-22481851
                                                                                        • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                        • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                        • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                        • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                        Function 004584D6 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                        • IIDFromString.COMBASE(?,?), ref: 004585EB
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseOpen$EnumFromQueryStringValue
                                                                                        • String ID: ($interface$interface\
                                                                                        • API String ID: 297354694-3327702407
                                                                                        • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                        • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                        • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                        • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                        Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                        • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorMode$DriveType
                                                                                        • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                        • API String ID: 2907320926-41864084
                                                                                        • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                        • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                        • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                        • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                        Function 0043737D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 83windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadIconW.USER32(00000000,00007F04), ref: 00437467
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: IconLoad
                                                                                        • String ID: blank$info$question$stop$warning
                                                                                        • API String ID: 2457776203-404129466
                                                                                        • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                        • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                        • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                        • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                        Function 0041D221 Relevance: 16.8, APIs: 11, Instructions: 340COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LCMapStringW.KERNEL32(00000000,00000100,004832AC,00000001,00000000,00000000,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D253
                                                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 0041D265
                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D2F1
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,?), ref: 0041D35D
                                                                                        • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,?), ref: 0041D379
                                                                                        • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 0041D3B3
                                                                                        • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 0041D417
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041D43A
                                                                                        • LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000000,00000100,?,?,?,?,?), ref: 0041D4CA
                                                                                        • LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,00000100,?,?), ref: 0041D53C
                                                                                        • LCMapStringA.KERNEL32(?,?,?,?,?,00000100,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D589
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: String$ByteCharMultiWide$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 1775797328-0
                                                                                        • Opcode ID: eb41e0d2d1b81e7a32cf906d4b734b1c9ec2c908055d8722ab31c7c9aa7183c2
                                                                                        • Instruction ID: 1947c5d7a6bd7703781e4ff4e4219a867b2a08f70101b14ec9db93f8b40ae8b3
                                                                                        • Opcode Fuzzy Hash: eb41e0d2d1b81e7a32cf906d4b734b1c9ec2c908055d8722ab31c7c9aa7183c2
                                                                                        • Instruction Fuzzy Hash: FFB19AB2C00119BFCF119FA0DC818EF7BB6EB48358B14456BF915A2220D7399DE1DB99
                                                                                        Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                        • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ArraySafe$Data$AccessUnaccess$Vartype
                                                                                        • String ID:
                                                                                        • API String ID: 1349711609-0
                                                                                        • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                        • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                        • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                        • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                        Function 0046FB53 Relevance: 16.7, APIs: 11, Instructions: 176windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                        • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                        • SendMessageW.USER32 ref: 0046FBAF
                                                                                        • SendMessageW.USER32 ref: 0046FBE2
                                                                                        • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                        • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$ExtractIcon
                                                                                        • String ID:
                                                                                        • API String ID: 2741346921-0
                                                                                        • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                        • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                        • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                        • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                        Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                        • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                        • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                        • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                        • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                        • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: State$Async$Keyboard
                                                                                        • String ID:
                                                                                        • API String ID: 541375521-0
                                                                                        • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                        • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                        • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                        • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                        Function 00479921 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 314COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                        • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                        • API String ID: 2286883814-4206948668
                                                                                        • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                        • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                        • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                        • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                        Function 00460473 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 255COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                        • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                        • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClassName$Window$Text$BuffCharRectUpper
                                                                                        • String ID: ThumbnailClass
                                                                                        • API String ID: 3725905772-1241985126
                                                                                        • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                        • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                        • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                        • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                        Function 00448DAF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 173windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                        • SendMessageW.USER32(763105F0,00001001,00000000,00000000), ref: 00448E73
                                                                                        • SendMessageW.USER32(763105F0,00001026,00000000,00000000), ref: 00448E7E
                                                                                          • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3771399671-2674840847
                                                                                        • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                        • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                        • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                        • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                        Function 00434506 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 162windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • 744DA3B0.USER32(00000000,?,?,?), ref: 00434585
                                                                                        • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                        • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BitsObjectSelectStretch
                                                                                        • String ID: (
                                                                                        • API String ID: 362862436-3887548279
                                                                                        • Opcode ID: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                        • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                        • Opcode Fuzzy Hash: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                                        • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                        Function 0045E41B Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 150COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                        • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: LoadString
                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                        • API String ID: 2948472770-2894483878
                                                                                        • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                        • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                        • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                        • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                        Function 004393E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                        • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                        • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                        Strings
                                                                                        • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                        • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread
                                                                                        • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                        • API String ID: 2833215880-805462909
                                                                                        • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                        • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                        • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                        • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                        Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                        • GetParent.USER32 ref: 004692A4
                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                        • GetParent.USER32 ref: 004692C7
                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CtrlParent
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 1383977212-1403004172
                                                                                        • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                        • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                        • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                        • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                        Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                        • GetParent.USER32 ref: 0046949E
                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                        • GetParent.USER32 ref: 004694C1
                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CtrlParent
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 1383977212-1403004172
                                                                                        • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                        • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                        • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                        • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                        Function 00417BA8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedIncrement.KERNEL32(00411739), ref: 00417BBA
                                                                                        • InterlockedIncrement.KERNEL32(681574C0), ref: 00417BC7
                                                                                        • InterlockedIncrement.KERNEL32(1015FF50), ref: 00417BD4
                                                                                        • InterlockedIncrement.KERNEL32(CorExitProcess), ref: 00417BE1
                                                                                        • InterlockedIncrement.KERNEL32(FF0574C0), ref: 00417BEE
                                                                                        • InterlockedIncrement.KERNEL32(FF0574C0), ref: 00417C0A
                                                                                        • InterlockedIncrement.KERNEL32(0048215C), ref: 00417C1A
                                                                                        • InterlockedIncrement.KERNEL32(59FFFF4B), ref: 00417C30
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: IncrementInterlocked
                                                                                        • String ID: CorExitProcess
                                                                                        • API String ID: 3508698243-1124507085
                                                                                        • Opcode ID: d1b0377c503bbdefda5610f0537bfa72825e28dfa37e5ae55eeee1a7a8820d3e
                                                                                        • Instruction ID: fb61f0e31799d0698f30908f9b652ac69b024978f93be2849cd97143da64a8c5
                                                                                        • Opcode Fuzzy Hash: d1b0377c503bbdefda5610f0537bfa72825e28dfa37e5ae55eeee1a7a8820d3e
                                                                                        • Instruction Fuzzy Hash: 11111E71B04315ABDB249B69CC84F97BBACAF40784F044427A508D7241DB78F980CBE4
                                                                                        Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                        • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                        • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                        • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                        • String ID:
                                                                                        • API String ID: 2156557900-0
                                                                                        • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                        • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                        • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                        • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                        Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                        • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DecrementInterlocked$Sleep
                                                                                        • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                        • API String ID: 2250217261-3412429629
                                                                                        • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                        • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                        • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                        • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                        Function 0045CBCC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 202COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                        • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                        • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CurrentDirectory$AttributesFile
                                                                                        • String ID: *.*
                                                                                        • API String ID: 769691225-438819550
                                                                                        • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                        • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                        • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                        • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                        Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConnectRegistry
                                                                                        • String ID: HH
                                                                                        • API String ID: 76216097-2761332787
                                                                                        • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                        • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                        • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                        • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                        Function 004180A7 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 161fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameA.KERNEL32(00000000,00496789,00000104,?,00411739,?,00401C0B), ref: 0041814A
                                                                                        • GetStdHandle.KERNEL32(000000F4,00000001,?,00000000,00000003,00000003,?,0041827E,000000FC,00418365,0048CA38,0000000C,00418422,00411739,?), ref: 0041821D
                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000000,00411739,00000000,?,0041827E,000000FC,00418365,0048CA38,0000000C,00418422,00411739,?,?,004224D3), ref: 00418247
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$HandleModuleNameWrite
                                                                                        • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $pgI
                                                                                        • API String ID: 3784150691-2686879112
                                                                                        • Opcode ID: e76ecb60561fe747eec25ea6da2aa861ca3e5a9d7f3461b9d4a94d885804126d
                                                                                        • Instruction ID: dd0201cc8d4d8b0dfcb57b62c9b49e6d742448a59313f766a6a12cff913f25f6
                                                                                        • Opcode Fuzzy Hash: e76ecb60561fe747eec25ea6da2aa861ca3e5a9d7f3461b9d4a94d885804126d
                                                                                        • Instruction Fuzzy Hash: DA410AB2B0021076DA222A769D8AFFF756C9B11B54F15013FFD0591292FE6D8A8241FD
                                                                                        Function 0045E62E Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 155COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                        • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: LoadString
                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                        • API String ID: 2948472770-2354261254
                                                                                        • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                        • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                        • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                        • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                        Function 0045FF4F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,0042B612,?,0000138C,?), ref: 0045FFDF
                                                                                        • LoadStringW.USER32(00000000), ref: 0045FFE2
                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF), ref: 00460005
                                                                                        • LoadStringW.USER32(00000000), ref: 00460008
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleLoadModuleString
                                                                                        • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d:$^ ERROR
                                                                                        • API String ID: 3590730445-2561132961
                                                                                        • Opcode ID: 3a0ba83e73347f9d66d327fa194003f337c112eb025fc1bfa34d21ba4accb515
                                                                                        • Instruction ID: 1782bf699798572b532e289ec277df613d4b2535fc1d09db4cdff265272d1083
                                                                                        • Opcode Fuzzy Hash: 3a0ba83e73347f9d66d327fa194003f337c112eb025fc1bfa34d21ba4accb515
                                                                                        • Instruction Fuzzy Hash: 7041EA725043059BC300FB61DC96A5F77A8DF91358F45093EB540A72D2EA7CDD09876B
                                                                                        Function 00450E7D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 120COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 0DNt$static
                                                                                        • API String ID: 0-3758526172
                                                                                        • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                        • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                        • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                        • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                        Function 00448602 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateMenu.USER32 ref: 0044863C
                                                                                        • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                        • IsMenu.USER32(?), ref: 004486EB
                                                                                        • CreatePopupMenu.USER32 ref: 004486F5
                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                        • DrawMenuBar.USER32 ref: 00448742
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                        • String ID: 0
                                                                                        • API String ID: 161812096-4108050209
                                                                                        • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                        • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                        • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                        • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                        Function 00445A77 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetParent.USER32 ref: 00445A8D
                                                                                        • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                        • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClassMessageNameParentSend
                                                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                        • API String ID: 1290815626-3381328864
                                                                                        • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                        • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                        • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                        • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                        Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                        • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                        • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                        • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                        Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                        • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                        • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                        • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                        Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                          • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                          • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                        • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                        • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                        • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                        • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                        • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                        • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2014098862-0
                                                                                        • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                        • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                        • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                        • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                        Function 0045E912 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 353timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                        • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                        • VariantClear.OLEAUT32 ref: 0045E970
                                                                                        • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                        • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                        Strings
                                                                                        • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Variant$InitTime$ClearCopyFromSystem
                                                                                        • String ID: %4d%02d%02d%02d%02d%02d
                                                                                        • API String ID: 2968790880-1568723262
                                                                                        • Opcode ID: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                        • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                        • Opcode Fuzzy Hash: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                                        • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                        Function 00474335 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 308COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: HH
                                                                                        • API String ID: 0-2761332787
                                                                                        • Opcode ID: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                        • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                        • Opcode Fuzzy Hash: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                                        • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                        Function 00479C97 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 274COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                        • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                          • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                          • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                          • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Variant$Copy$ClearInit$ErrorLast
                                                                                        • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                        • API String ID: 2268567065-60002521
                                                                                        • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                        • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                        • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                        • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                        Function 00436B3A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 190COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • 759E1560.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: E1560
                                                                                        • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                        • API String ID: 2479044930-1459072770
                                                                                        • Opcode ID: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                        • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                        • Opcode Fuzzy Hash: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                                        • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                        Function 0045DB3E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CoInitialize.OLE32(00000000), ref: 0045DB99
                                                                                        • SHGetMalloc.SHELL32(?), ref: 0045DBA8
                                                                                        • SHGetDesktopFolder.SHELL32(?,?), ref: 0045DC38
                                                                                        • SHBrowseForFolderW.SHELL32 ref: 0045DCF5
                                                                                        • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0045DD13
                                                                                        • CoUninitialize.COMBASE ref: 0045DD6B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Folder$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                        • String ID: HH
                                                                                        • API String ID: 2328888689-2761332787
                                                                                        • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                        • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                        • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                        • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                        Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                        • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                        • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                        • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                        • String ID:
                                                                                        • API String ID: 1291720006-3916222277
                                                                                        • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                        • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                        • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                        • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                        Function 0045F2C5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                        • IsMenu.USER32(?), ref: 0045F380
                                                                                        • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                        • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                        • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                        • String ID: 0$2
                                                                                        • API String ID: 93392585-3793063076
                                                                                        • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                        • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                        • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                        • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                        Function 004507E7 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                        • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                        • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Window
                                                                                        • String ID: -----$SysListView32
                                                                                        • API String ID: 2326795674-3975388722
                                                                                        • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                        • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                        • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                        • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                        Function 0046FD7F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                        • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                        • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                        • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                        • DestroyCursor.USER32(?), ref: 0046FFCC
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$ClientCursorDestroyExtractIconRect
                                                                                        • String ID: 2
                                                                                        • API String ID: 1821208316-450215437
                                                                                        • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                        • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                        • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                        • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                        Function 00436582 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WSAStartup.WS2_32(00000101,?), ref: 004365A5
                                                                                        • gethostname.WS2_32(00000100,00000100), ref: 004365BC
                                                                                        • gethostbyname.WS2_32(00000101), ref: 004365C6
                                                                                        • WSACleanup.WS2_32 ref: 004365FD
                                                                                        • inet_ntoa.WS2_32(00000100), ref: 00436624
                                                                                        • WSACleanup.WS2_32 ref: 00436652
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Cleanup$Startupgethostbynamegethostnameinet_ntoa
                                                                                        • String ID: 0.0.0.0
                                                                                        • API String ID: 1500336939-3771769585
                                                                                        • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                        • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                        • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                        • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                        Function 00416B12 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                        • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                        • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                          • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                          • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc$IncrementInterlockedSleep
                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                        • API String ID: 3998264955-2843748187
                                                                                        • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                        • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                        • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                        • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                        Function 0043717F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\Payment Advice.exe), ref: 0043719E
                                                                                        • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                        • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                        • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                        Strings
                                                                                        • C:\Users\user\Desktop\Payment Advice.exe, xrefs: 00437189
                                                                                        • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleLoadModuleString$Message
                                                                                        • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\Payment Advice.exe
                                                                                        • API String ID: 4072794657-3413294125
                                                                                        • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                        • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                        • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                        • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                        Function 0046ECBF Relevance: 12.1, APIs: 8, Instructions: 101COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: InitVariant
                                                                                        • String ID:
                                                                                        • API String ID: 1927566239-0
                                                                                        • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                        • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                        • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                        • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                        Function 00417C37 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedDecrement.KERNEL32(00000000), ref: 00417C51
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417C5E
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417C6B
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417C78
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417C85
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417CA1
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417CB1
                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00417CC7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DecrementInterlocked
                                                                                        • String ID:
                                                                                        • API String ID: 3448037634-0
                                                                                        • Opcode ID: e3e593b2512a4258f70d79ada8771ba765959c03c41681832578354204dfbbb8
                                                                                        • Instruction ID: a6556518ad8db110cb1b00e702d9e0698ae62f30edd3f87937ee49336a9ec4f3
                                                                                        • Opcode Fuzzy Hash: e3e593b2512a4258f70d79ada8771ba765959c03c41681832578354204dfbbb8
                                                                                        • Instruction Fuzzy Hash: ED11FE71B04615A7DB109B69DD84B97B7ADAF40741F084417A808D7340EB78E9908BE8
                                                                                        Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                        • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                        • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                        • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                        • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                        • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                        • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                        • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClearVariant
                                                                                        • String ID:
                                                                                        • API String ID: 1473721057-0
                                                                                        • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                        • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                        • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                        • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                        Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConnectRegistry
                                                                                        • String ID:
                                                                                        • API String ID: 76216097-0
                                                                                        • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                        • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                        • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                        • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                        Function 00401D10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                        • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                        • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Free$LibrarySendStringUnregisterVirtual
                                                                                        • String ID: close all
                                                                                        • API String ID: 2389397985-3243417748
                                                                                        • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                        • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                        • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                        • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                        Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                        • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                        • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                        • String ID: HH
                                                                                        • API String ID: 3488606520-2761332787
                                                                                        • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                        • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                        • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                        • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                        Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                        • String ID:
                                                                                        • API String ID: 4082120231-0
                                                                                        • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                        • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                        • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                        • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                        Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                        • String ID:
                                                                                        • API String ID: 4082120231-0
                                                                                        • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                        • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                        • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                        • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                        Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                        • String ID:
                                                                                        • API String ID: 288456094-0
                                                                                        • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                        • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                        • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                        • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                        Function 0042540D Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCPInfo.KERNEL32(00000000,?,00000000,00000001,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00425458
                                                                                        • GetCPInfo.KERNEL32(00000000,00000001,?,?,?,0041D4AE,00000000,00000000,?), ref: 00425471
                                                                                        • MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,00000000,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000), ref: 004254CF
                                                                                        • MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,?,00000000,?,?,?,?,?,?,0041D4AE,00000000,00000000,?), ref: 0042551E
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425539
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 0042555F
                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425584
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$Info
                                                                                        • String ID:
                                                                                        • API String ID: 1775632426-0
                                                                                        • Opcode ID: 691f6279820d20f455e7befef3e0fcba74c582925611e7755a6e8405b10c4f55
                                                                                        • Instruction ID: cfbbdbeff2fc93c5700b589297128cc5131deecd4fa0efd2065aadc2599a9f50
                                                                                        • Opcode Fuzzy Hash: 691f6279820d20f455e7befef3e0fcba74c582925611e7755a6e8405b10c4f55
                                                                                        • Instruction Fuzzy Hash: F351A231E00628AFCF219F95EC44DEFBBB5EF88311F60011AF914A2250D3398D81CB68
                                                                                        Function 0046BB59 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastselect
                                                                                        • String ID: HH
                                                                                        • API String ID: 215497628-2761332787
                                                                                        • Opcode ID: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                        • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                        • Opcode Fuzzy Hash: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                                        • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                        Function 0046EA7F Relevance: 10.7, APIs: 7, Instructions: 167COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                        • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                        • DeleteObject.GDI32(00450000), ref: 0046EB4F
                                                                                        • DestroyCursor.USER32(0057003D), ref: 0046EB67
                                                                                        • DeleteObject.GDI32(7F7E456E), ref: 0046EB7F
                                                                                        • DestroyCursor.USER32(?), ref: 0046EBBF
                                                                                        • DestroyCursor.USER32(?), ref: 0046EBCD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Destroy$Cursor$DeleteObject$AcceleratorInvalidateRectTable
                                                                                        • String ID:
                                                                                        • API String ID: 3205914843-0
                                                                                        • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                        • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                        • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                        • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                        Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetParent.USER32(?), ref: 004449B0
                                                                                        • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                        • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                        • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                        • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                        • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                        • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                        • String ID:
                                                                                        • API String ID: 87235514-0
                                                                                        • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                        • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                        • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                        • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                        Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetParent.USER32(?), ref: 00444BA9
                                                                                        • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                        • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                        • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                        • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                        • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                        • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                        • String ID:
                                                                                        • API String ID: 87235514-0
                                                                                        • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                        • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                        • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                        • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                        Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConnectRegistry
                                                                                        • String ID: HH
                                                                                        • API String ID: 76216097-2761332787
                                                                                        • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                        • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                        • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                        • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                        Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                        • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Enable$Show$MessageMoveSend
                                                                                        • String ID:
                                                                                        • API String ID: 896007046-0
                                                                                        • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                        • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                        • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                        • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                        Function 00455EF5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32 ref: 00455F43
                                                                                        • SendMessageW.USER32(?,0000104B,00000000,?), ref: 00455F82
                                                                                        • SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00455FF5
                                                                                        • CharNextW.USER32(00000000,?,?,?), ref: 00456034
                                                                                        • SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00456060
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CharNext
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 1350042424-2674840847
                                                                                        • Opcode ID: 1e0cf8b8d25046b6848c8f46273bd4d506c8fc7d824d1fae03d8575ab44ef5d5
                                                                                        • Instruction ID: 728fd5b54b682decfcd50b06f9b7fb359c8698431e162ed45c662fcf507213b6
                                                                                        • Opcode Fuzzy Hash: 1e0cf8b8d25046b6848c8f46273bd4d506c8fc7d824d1fae03d8575ab44ef5d5
                                                                                        • Instruction Fuzzy Hash: 5D41D172204241ABE3108F68DC45BABB7E4FB84321F004A2EF954D72D1E7B9904A8B66
                                                                                        Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                        • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                        • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                        • String ID: 0vH
                                                                                        • API String ID: 327565842-3662162768
                                                                                        • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                        • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                        • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                        • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                        Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                        • GetFocus.USER32 ref: 00448B1C
                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Enable$Show$FocusMessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 3429747543-0
                                                                                        • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                        • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                        • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                        • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                        Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                        • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                        • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                        • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: Msctls_Progress32
                                                                                        • API String ID: 3850602802-3636473452
                                                                                        • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                        • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                        • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                        • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                        Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                          • Part of subcall function 00438FE4: RtlAllocateHeap.NTDLL(00000000), ref: 00438FEF
                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                        • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
                                                                                        • String ID:
                                                                                        • API String ID: 1422014791-0
                                                                                        • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                        • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                        • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                        • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                        Function 0041696E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TlsGetValue.KERNEL32(00000000,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 00416980
                                                                                        • TlsGetValue.KERNEL32(00000005,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 00416997
                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 004169AD
                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004169C8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Value$AddressHandleModuleProc
                                                                                        • String ID: EncodePointer$KERNEL32.DLL
                                                                                        • API String ID: 1929421221-3682587211
                                                                                        • Opcode ID: f1787378902819e9947f97c0fd6b8d9b320c13b2552bb88f8caa1f2ac1665e6d
                                                                                        • Instruction ID: e5bba5b00aa6f8354d24bce9220d26f317535e3d8edc7be22519ce0301cf3cdb
                                                                                        • Opcode Fuzzy Hash: f1787378902819e9947f97c0fd6b8d9b320c13b2552bb88f8caa1f2ac1665e6d
                                                                                        • Instruction Fuzzy Hash: 4CF0C2B0210111AF8F209B35DD449EF3A98AF403657064437FC1DD62A0DB38DC81C79D
                                                                                        Function 004169E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TlsGetValue.KERNEL32(00411739,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 004169FB
                                                                                        • TlsGetValue.KERNEL32(00000005,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A12
                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A28
                                                                                        • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00416A43
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Value$AddressHandleModuleProc
                                                                                        • String ID: DecodePointer$KERNEL32.DLL
                                                                                        • API String ID: 1929421221-629428536
                                                                                        • Opcode ID: 0b3d26fac8f7b222a059dde4d81d242a9bd92865164bd8a543a794d3b2e1d27d
                                                                                        • Instruction ID: 6b6853f7d3ee3eb9e65f39b7335b34cb1b7d5f0f3521d7c85aee421bb533db53
                                                                                        • Opcode Fuzzy Hash: 0b3d26fac8f7b222a059dde4d81d242a9bd92865164bd8a543a794d3b2e1d27d
                                                                                        • Instruction Fuzzy Hash: 65F04430600115AB8B209B75DD44ADF3F99AF423E0715843BFC18E62A0EB38DD41879C
                                                                                        Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                        • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                        • API String ID: 2574300362-3261711971
                                                                                        • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                        • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                        • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                        • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                        Function 00464A0E Relevance: 9.3, APIs: 6, Instructions: 281networkmemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WSAStartup.WS2_32(00000101,?), ref: 00464ADE
                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                        • inet_addr.WS2_32(?), ref: 00464B1F
                                                                                        • gethostbyname.WS2_32(?), ref: 00464B29
                                                                                        • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                        • WSACleanup.WS2_32 ref: 00464CE4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Global$AllocByteCharCleanupFreeMultiStartupWidegethostbynameinet_addr
                                                                                        • String ID:
                                                                                        • API String ID: 867222529-0
                                                                                        • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                        • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                        • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                        • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                        Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetClientRect.USER32(?,?), ref: 00433724
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                        • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                        • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                        • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                        • String ID:
                                                                                        • API String ID: 3220332590-0
                                                                                        • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                        • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                        • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                        • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                        Function 00422806 Relevance: 9.2, APIs: 6, Instructions: 166COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStringTypeW.KERNEL32(00000001,004832AC,00000001,?,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?,?,?), ref: 00422835
                                                                                        • GetLastError.KERNEL32(?,004229F0,00000001,?,?,?,?,?,?,?,?,00000001,?,?,?,00000001), ref: 00422847
                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?), ref: 004228AC
                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,00000001,?,?,?,00000001,?), ref: 00422916
                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00422924
                                                                                        • GetStringTypeA.KERNEL32(?,?,?,?,?,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?,?), ref: 00422999
                                                                                          • Part of subcall function 0042540D: GetCPInfo.KERNEL32(00000000,?,00000000,00000001,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00425458
                                                                                          • Part of subcall function 0042540D: GetCPInfo.KERNEL32(00000000,00000001,?,?,?,0041D4AE,00000000,00000000,?), ref: 00425471
                                                                                          • Part of subcall function 0042540D: MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,?,00000000,?,?,?,?,?,?,0041D4AE,00000000,00000000,?), ref: 0042551E
                                                                                          • Part of subcall function 0042540D: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425539
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide$StringType$Info$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 2250435928-0
                                                                                        • Opcode ID: 773a929a23efa12b5da778aefeae380a86b05995ea6eda526da0bbf57dde95d5
                                                                                        • Instruction ID: 0f324d561209b13029d01e9070866e268b39bf3e2f15ac4abc19e924a9dc5289
                                                                                        • Opcode Fuzzy Hash: 773a929a23efa12b5da778aefeae380a86b05995ea6eda526da0bbf57dde95d5
                                                                                        • Instruction Fuzzy Hash: E751A27170022ABFDF10AF64ED819AF3BA9FB04754F90052BF910D6250D6B9CDA0DB98
                                                                                        Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                        • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                        • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                        • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                        • SendInput.USER32 ref: 0044C6E2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePost$KeyboardState$InputSend
                                                                                        • String ID:
                                                                                        • API String ID: 2221674350-0
                                                                                        • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                        • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                        • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                        • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                        Function 0047762A Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                        • GetMenu.USER32 ref: 004776AA
                                                                                        • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                        • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$CountItemStringWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2847105600-0
                                                                                        • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                        • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                        • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                        • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                        Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                        • String ID:
                                                                                        • API String ID: 4189319755-0
                                                                                        • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                        • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                        • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                        • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                        Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                        • RtlEnterCriticalSection.NTDLL(00000000), ref: 0044B4E3
                                                                                        • RtlLeaveCriticalSection.NTDLL(00000000), ref: 0044B5A0
                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                        • String ID:
                                                                                        • API String ID: 3368777196-0
                                                                                        • Opcode ID: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                        • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                        • Opcode Fuzzy Hash: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                                        • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                        Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                        • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                        • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                        • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                        • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Show$Enable$MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 642888154-0
                                                                                        • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                        • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                        • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                        • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                        Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetForegroundWindow.USER32 ref: 00442597
                                                                                          • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                        • GetDesktopWindow.USER32 ref: 004425BF
                                                                                        • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                        • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                        • GetCursorPos.USER32(?), ref: 00442624
                                                                                        • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                        • String ID:
                                                                                        • API String ID: 4137160315-0
                                                                                        • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                        • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                        • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                        • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                        Function 00441561 Relevance: 9.1, APIs: 6, Instructions: 101windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteObject.GDI32(?), ref: 0044157D
                                                                                        • 744DA3B0.USER32(00000000,?,?,?,?,?,0045193C,?,?,?,?,000000FF,?,?,00000001,?), ref: 00441585
                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                        • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CreateDeleteFontMoveObjectWindow
                                                                                        • String ID:
                                                                                        • API String ID: 3202464795-0
                                                                                        • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                        • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                        • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                        • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                        Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Enable$Show$MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 1871949834-0
                                                                                        • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                        • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                        • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                        • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                        Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                        • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                        • String ID:
                                                                                        • API String ID: 2833360925-0
                                                                                        • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                        • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                        • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                        • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                        Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                        • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                        • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                        • EndPath.GDI32(?), ref: 0044724E
                                                                                        • StrokePath.GDI32(?), ref: 0044725C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                        • String ID:
                                                                                        • API String ID: 372113273-0
                                                                                        • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                        • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                        • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                        • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                        Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                        • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                        • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                        • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                        • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Virtual
                                                                                        • String ID:
                                                                                        • API String ID: 4278518827-0
                                                                                        • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                        • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                        • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                        • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                        Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                        • RtlEnterCriticalSection.NTDLL(0042A321), ref: 0044B67B
                                                                                        • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                          • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                        • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                        • RtlLeaveCriticalSection.NTDLL(0042A321), ref: 0044B6AF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                        • String ID:
                                                                                        • API String ID: 3495660284-0
                                                                                        • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                        • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                        • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                        • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                        Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                        • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                        • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                        • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                        • String ID:
                                                                                        • API String ID: 839392675-0
                                                                                        • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                        • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                        • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                        • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                        Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\Payment Advice.exe,00000004), ref: 00436055
                                                                                        • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                        • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                        • GetLastError.KERNEL32 ref: 00436081
                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                        • String ID:
                                                                                        • API String ID: 1690418490-0
                                                                                        • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                        • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                        • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                        • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                        Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                        • CoCreateInstance.COMBASE(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                        • CoUninitialize.COMBASE ref: 00475D71
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateInitializeInstanceUninitialize
                                                                                        • String ID: .lnk$HH
                                                                                        • API String ID: 948891078-3121654589
                                                                                        • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                        • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                        • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                        • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                        Function 00449063 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                        • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$InvalidateRect
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 2778011698-2674840847
                                                                                        • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                        • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                        • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                        • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                        Function 0044849C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                        • IsMenu.USER32(?), ref: 0044857B
                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                        • DrawMenuBar.USER32 ref: 004485E4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$Item$DrawInfoInsert
                                                                                        • String ID: 0
                                                                                        • API String ID: 3076010158-4108050209
                                                                                        • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                        • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                        • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                        • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                        Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                        • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 3850602802-1403004172
                                                                                        • Opcode ID: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                        • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                        • Opcode Fuzzy Hash: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                                        • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                        Function 004366BE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                        • GetLastError.KERNEL32 ref: 0043670F
                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                          • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                        • String ID: \
                                                                                        • API String ID: 2267087916-2967466578
                                                                                        • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                        • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                        • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                        • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                        Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75C82EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                        • String ID: nul
                                                                                        • API String ID: 2124370227-2873401336
                                                                                        • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                        • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                        • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                        • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                        Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75C82EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                        • String ID: nul
                                                                                        • API String ID: 2124370227-2873401336
                                                                                        • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                        • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                        • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                        • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                        Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                        • TranslateMessage.USER32(?), ref: 0044308B
                                                                                        • DispatchMessageW.USER32(?), ref: 00443096
                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Message$Peek$DispatchTranslate
                                                                                        • String ID: *.*
                                                                                        • API String ID: 1795658109-438819550
                                                                                        • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                        • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                        • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                        • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                        Function 0045D321 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                        • String ID: %lu$HH
                                                                                        • API String ID: 2507767853-3924996404
                                                                                        • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                        • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                        • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                        • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                        Function 0047B1D0 Relevance: 8.0, APIs: 5, Instructions: 489COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                        • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                        • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                        • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                        Function 00452788 Relevance: 7.8, APIs: 5, Instructions: 344COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                        • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                        • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                        • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                        Function 00421CAB Relevance: 7.7, APIs: 5, Instructions: 214COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000001,00000000,?), ref: 00421E57
                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,?,-00000001,?,?,00000000,?,00415F8A,00000000,?), ref: 00421ED0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide
                                                                                        • String ID:
                                                                                        • API String ID: 626452242-0
                                                                                        • Opcode ID: 1ea55d7c848440a8403a6ff58c98b5aa76672f86defd2e698422c6d464e36b7c
                                                                                        • Instruction ID: bd3898d71cbd482aa4aa0b4c35bbdddb761c1f54cbd41572929d464e4e701234
                                                                                        • Opcode Fuzzy Hash: 1ea55d7c848440a8403a6ff58c98b5aa76672f86defd2e698422c6d464e36b7c
                                                                                        • Instruction Fuzzy Hash: 1371BF71A0026ADFCF20DF94EC808BFB7B5FB65314B95052BE521A7260D7349D81CB69
                                                                                        Function 0041B669 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetStartupInfoA.KERNEL32(?), ref: 0041B67E
                                                                                          • Part of subcall function 00416FFB: Sleep.KERNEL32(00000000,?,00411739,?,00401C0B), ref: 00417023
                                                                                        • GetFileType.KERNEL32(00000040), ref: 0041B7A8
                                                                                        • GetStdHandle.KERNEL32(-000000F6), ref: 0041B832
                                                                                        • GetFileType.KERNEL32(00000000), ref: 0041B844
                                                                                        • SetHandleCount.KERNEL32 ref: 0041B89C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileHandleType$CountInfoSleepStartup
                                                                                        • String ID:
                                                                                        • API String ID: 1302456922-0
                                                                                        • Opcode ID: 042631592d203edaaf3f4d78f5e16ed03b675539f236fb7f0781e26425fee0e7
                                                                                        • Instruction ID: 78394165c801ef16868fb9e1c6e049db50f2448aaa9d77fd502763510830d482
                                                                                        • Opcode Fuzzy Hash: 042631592d203edaaf3f4d78f5e16ed03b675539f236fb7f0781e26425fee0e7
                                                                                        • Instruction Fuzzy Hash: 4E7124715047418FDB209B28C8847AABBF0EF46724F29465ED4A59B3E1C77CD882CB99
                                                                                        Function 00422570 Relevance: 7.7, APIs: 5, Instructions: 181COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A), ref: 00413931
                                                                                        • GetLastError.KERNEL32(?,00411376,00000000,00000010,?,?,?,00411402,00411766,0048C6A8,0000000C,0041142E,00411766,?,00411766), ref: 004226EB
                                                                                        • GetLastError.KERNEL32(?,00411376,00000000,00000010,?,?,?,00411402,00411766,0048C6A8,0000000C,0041142E,00411766,?,00411766), ref: 00422778
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 4219743298-0
                                                                                        • Opcode ID: 2fd8fadab811a430797da95cb73ff5430e569562758129bd436d71f1837a3659
                                                                                        • Instruction ID: 318ae3f89a2250df876bedb69491e74a10a758e61cab592b37fb59630da9e0ad
                                                                                        • Opcode Fuzzy Hash: 2fd8fadab811a430797da95cb73ff5430e569562758129bd436d71f1837a3659
                                                                                        • Instruction Fuzzy Hash: 38510A71E04231BACF216B75BE44AAF7A64EF40364B60452BF85467391DBBC8C818B9D
                                                                                        Function 004498BD Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                        • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                        • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                        • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                        Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                        • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$Library$FreeLoad
                                                                                        • String ID:
                                                                                        • API String ID: 2449869053-0
                                                                                        • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                        • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                        • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                        • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                        Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                        • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                        • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                        • SendInput.USER32 ref: 0044C509
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: KeyboardMessagePostState$InputSend
                                                                                        • String ID:
                                                                                        • API String ID: 3031425849-0
                                                                                        • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                        • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                        • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                        • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                        Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                        • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Enum$CloseDeleteOpen
                                                                                        • String ID:
                                                                                        • API String ID: 2095303065-0
                                                                                        • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                        • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                        • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                        • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                        Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                        • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfile$SectionWrite$String
                                                                                        • String ID:
                                                                                        • API String ID: 2832842796-0
                                                                                        • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                        • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                        • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                        • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                        Function 00436EC8 Relevance: 7.6, APIs: 5, Instructions: 103COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • EnumProcesses.PSAPI(?,00000800,?,?,00444263,?,?,?), ref: 00436EEC
                                                                                        • OpenProcess.KERNEL32(00000410,00000000,?,?,?), ref: 00436F44
                                                                                        • EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 00436F59
                                                                                        • GetModuleBaseNameW.PSAPI(00000000,?,?,00000104,00000000,?,00000004,?), ref: 00436F71
                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?,00000104,00000000,?,00000004,?), ref: 00437003
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: EnumProcess$BaseCloseHandleModuleModulesNameOpenProcesses
                                                                                        • String ID:
                                                                                        • API String ID: 2155911829-0
                                                                                        • Opcode ID: 7292045517b03260f1320f87d3cebc28a29f897dca793e666df8b3a842c294cc
                                                                                        • Instruction ID: e95795bff0e4a6f47310c77509a1ee8dff79588992f1933afd8058d7896a4498
                                                                                        • Opcode Fuzzy Hash: 7292045517b03260f1320f87d3cebc28a29f897dca793e666df8b3a842c294cc
                                                                                        • Instruction Fuzzy Hash: C831A5B5108341ABD725DF54D881EEF73E8BBC8704F00891EF6C587241DBB9AA89C766
                                                                                        Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                        • String ID:
                                                                                        • API String ID: 659298297-0
                                                                                        • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                        • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                        • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                        • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                        Function 00438EAD Relevance: 7.6, APIs: 5, Instructions: 90sleepwindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowRect.USER32(?,?), ref: 00438ECC
                                                                                        • PostMessageW.USER32(00000001,?,00000001,?), ref: 00438F7C
                                                                                        • Sleep.KERNEL32(00000000), ref: 00438F84
                                                                                        • PostMessageW.USER32(?,00000202,00000000,?), ref: 00438F95
                                                                                        • Sleep.KERNEL32(00000000,?,00000202,00000000,?), ref: 00438F9D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessagePostSleep$RectWindow
                                                                                        • String ID:
                                                                                        • API String ID: 3382505437-0
                                                                                        • Opcode ID: 2ab6e8217c4101ef9f031d568675ad0bf41e28325206932565347c4090b4e9a4
                                                                                        • Instruction ID: 0163f4fbfa3540aa74b75641586733f0f0ecdd6424bf32d6baecdffd05b1cde8
                                                                                        • Opcode Fuzzy Hash: 2ab6e8217c4101ef9f031d568675ad0bf41e28325206932565347c4090b4e9a4
                                                                                        • Instruction Fuzzy Hash: 9B31C032104305AFD300CF68CA88A6BB7E5EBC8314F555A2DF9A497291DB74EC06CB56
                                                                                        Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(033E1BE0,000000F1,00000000,00000000), ref: 004414C6
                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(033E1BE0,000000F1,00000001,00000000), ref: 004414F1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$EnableMessageSend$Show
                                                                                        • String ID:
                                                                                        • API String ID: 476717838-0
                                                                                        • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                        • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                        • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                        • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                        Function 0042513E Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteConsoleW.KERNEL32(FFFFFFFE,00000000,00000001,00000000,00000000,00000000,00000000,00000002,00000000), ref: 00425186
                                                                                        • GetLastError.KERNEL32 ref: 00425199
                                                                                        • GetConsoleOutputCP.KERNEL32(00000000,00000000,00000001,00000002,00000005,00000000,00000000,00000000,00000000,00000002,00000000), ref: 004251B9
                                                                                        • WideCharToMultiByte.KERNEL32(00000000), ref: 004251C0
                                                                                        • WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 004251DC
                                                                                          • Part of subcall function 00426D55: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00425169,00000000,00000000,00000002,00000000), ref: 00426D68
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
                                                                                        • String ID:
                                                                                        • API String ID: 1850339568-0
                                                                                        • Opcode ID: 3fde0de84140aa5b76e31e7b27ee8f43fdf9ca56f866119cd92f9b765763b0e7
                                                                                        • Instruction ID: d0f421d0a58dc8f93451a55b2dc7c171cc865a771fc7fc24c42c122e9cb4cc85
                                                                                        • Opcode Fuzzy Hash: 3fde0de84140aa5b76e31e7b27ee8f43fdf9ca56f866119cd92f9b765763b0e7
                                                                                        • Instruction Fuzzy Hash: 3521A135E00625AFD7109B65EC08EBB3768EB50360F81463FF522C61A0DBB89A41CF99
                                                                                        Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004647A2: inet_addr.WS2_32(?), ref: 004647C7
                                                                                        • socket.WS2_32(00000002,00000001,00000006), ref: 00464985
                                                                                        • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                        • connect.WS2_32(00000000,00000000,00000010), ref: 004649CD
                                                                                        • WSAGetLastError.WS2_32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                        • closesocket.WS2_32(00000000), ref: 00464A07
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                        • String ID:
                                                                                        • API String ID: 245547762-0
                                                                                        • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                        • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                        • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                        • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                        Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                        • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                        • BeginPath.GDI32(?), ref: 004471B7
                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Object$Select$BeginCreateDeletePath
                                                                                        • String ID:
                                                                                        • API String ID: 2338827641-0
                                                                                        • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                        • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                        • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                        • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                        Function 004554C0 Relevance: 7.6, APIs: 5, Instructions: 61windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32 ref: 004554DF
                                                                                        • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                        • DestroyCursor.USER32(?), ref: 0045566A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteMessageObjectSend$CursorDestroy
                                                                                        • String ID:
                                                                                        • API String ID: 200077650-0
                                                                                        • Opcode ID: ffa48d2e2d11f5822c9307e130f04c04612b40de96aa83af3d3ccf64d5c683ef
                                                                                        • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                        • Opcode Fuzzy Hash: ffa48d2e2d11f5822c9307e130f04c04612b40de96aa83af3d3ccf64d5c683ef
                                                                                        • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                        Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CounterPerformanceQuerySleep
                                                                                        • String ID:
                                                                                        • API String ID: 2875609808-0
                                                                                        • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                        • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                        • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                        • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                        Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                        • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                        • DestroyCursor.USER32(?), ref: 0046FD58
                                                                                        • DestroyCursor.USER32(?), ref: 0046FD5F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$CursorDestroy
                                                                                        • String ID:
                                                                                        • API String ID: 1839592766-0
                                                                                        • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                        • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                        • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                        • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                        Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                        • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                        • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                        • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                        • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                        • String ID:
                                                                                        • API String ID: 3741023627-0
                                                                                        • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                        • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                        • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                        • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                        Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                        • String ID:
                                                                                        • API String ID: 2625713937-0
                                                                                        • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                        • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                        • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                        • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                        Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: Default$|k
                                                                                        • API String ID: 0-2254895183
                                                                                        • Opcode ID: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                        • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                        • Opcode Fuzzy Hash: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                                        • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                        Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                        • CoCreateInstance.COMBASE(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                        • CoUninitialize.COMBASE ref: 0046CE50
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateInitializeInstanceUninitialize
                                                                                        • String ID: .lnk
                                                                                        • API String ID: 948891078-24824748
                                                                                        • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                        • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                        • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                        • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                        Function 0045377F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                        • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                        • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ItemMenu$Info$Default
                                                                                        • String ID: 0
                                                                                        • API String ID: 1306138088-4108050209
                                                                                        • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                        • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                        • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                        • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                        Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                        • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Variant$ClearCopyInit
                                                                                        • String ID: 4RH
                                                                                        • API String ID: 1785138364-749298218
                                                                                        • Opcode ID: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                        • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                        • Opcode Fuzzy Hash: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                                        • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                        Function 00457C08 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseExecuteHandleShell
                                                                                        • String ID: <$@
                                                                                        • API String ID: 283469938-1426351568
                                                                                        • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                        • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                        • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                        • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                        Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                        • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                          • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                        • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                        • String ID: @
                                                                                        • API String ID: 4055202900-2766056989
                                                                                        • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                        • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                        • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                        • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                        Function 0045F132 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32 ref: 0045F1B9
                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 0045F218
                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 0045F27A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$Delete$InfoItem
                                                                                        • String ID: 0
                                                                                        • API String ID: 135850232-4108050209
                                                                                        • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                        • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                        • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                        • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                        Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                        • HttpQueryInfoW.WININET ref: 0044A892
                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                        • String ID:
                                                                                        • API String ID: 3705125965-3916222277
                                                                                        • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                        • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                        • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                        • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                        Function 004413F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                        • SendMessageW.USER32(033E1BE0,000000F1,00000000,00000000), ref: 004414C6
                                                                                        • SendMessageW.USER32(033E1BE0,000000F1,00000001,00000000), ref: 004414F1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3850602802-2674840847
                                                                                        • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                        • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                        • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                        • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                        Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                        • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                        • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$AddressFreeLoadProc
                                                                                        • String ID: AU3_GetPluginDetails
                                                                                        • API String ID: 145871493-4132174516
                                                                                        • Opcode ID: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                        • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                        • Opcode Fuzzy Hash: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                                        • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                        Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                        • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$MoveWindow
                                                                                        • String ID: Listbox
                                                                                        • API String ID: 3315199576-2633736733
                                                                                        • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                        • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                        • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                        • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                        Function 004412AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                        • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                        • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$LibraryLoad
                                                                                        • String ID: SysAnimate32
                                                                                        • API String ID: 3205928328-1011021900
                                                                                        • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                        • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                        • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                        • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                        Function 004416D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 0-2674840847
                                                                                        • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                        • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                        • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                        • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                        Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                        • String ID: HH
                                                                                        • API String ID: 2507767853-2761332787
                                                                                        • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                        • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                        • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                        • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                        Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                        • String ID: HH
                                                                                        • API String ID: 2507767853-2761332787
                                                                                        • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                        • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                        • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                        • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                        Function 00448C8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32 ref: 00448CB8
                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                        • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: 0DNt
                                                                                        • API String ID: 3850602802-2674840847
                                                                                        • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                        • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                        • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                        • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                        Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                        • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                        • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: msctls_trackbar32
                                                                                        • API String ID: 3850602802-1010561917
                                                                                        • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                        • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                        • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                        • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                        Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                        • gethostbyname.WS2_32(?), ref: 0046BD78
                                                                                        • WSAGetLastError.WS2_32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                        • inet_ntoa.WS2_32(00000000), ref: 0046BDCD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                        • String ID: HH
                                                                                        • API String ID: 1515696956-2761332787
                                                                                        • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                        • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                        • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                        • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                        Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                        • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                        • DrawMenuBar.USER32 ref: 00449828
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Menu$InfoItem$Draw
                                                                                        • String ID: 0
                                                                                        • API String ID: 3227129158-4108050209
                                                                                        • Opcode ID: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                        • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                        • Opcode Fuzzy Hash: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                                        • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                        Function 00416AD5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TlsFree.KERNEL32(00000017,00416FB1), ref: 00416B00
                                                                                        • RtlDeleteCriticalSection.NTDLL(00000000), ref: 004182F3
                                                                                        • RtlDeleteCriticalSection.NTDLL(00000017), ref: 0041831D
                                                                                          • Part of subcall function 004169E9: TlsGetValue.KERNEL32(00411739,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 004169FB
                                                                                          • Part of subcall function 004169E9: TlsGetValue.KERNEL32(00000005,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A12
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalDeleteSectionValue$Free
                                                                                        • String ID: KERNEL32.DLL
                                                                                        • API String ID: 3936257031-2576044830
                                                                                        • Opcode ID: 4edcc429f782e47b3d6ca153a441a70e2b111d037376c7f0eede9fe860c843eb
                                                                                        • Instruction ID: f80bf491939f1815d6b95db29b547c1add7b203e7a040b93f80d5043d0177117
                                                                                        • Opcode Fuzzy Hash: 4edcc429f782e47b3d6ca153a441a70e2b111d037376c7f0eede9fe860c843eb
                                                                                        • Instruction Fuzzy Hash: 530140329006109FCA345B689D8589A77A8AF61735325477FE8B8E32E0CF3D9C81C65D
                                                                                        Function 00424F47 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,0041AEF9), ref: 00424F4C
                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00424F5C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                        • API String ID: 1646373207-3105848591
                                                                                        • Opcode ID: e8a2c195ee76dfd59a84a35b1cdf9e15a3b06e47dea4a5400648535d534bf17f
                                                                                        • Instruction ID: 69bd3651b8917f7fc34e3109133611cda39c57594410afc054872b2319d2a534
                                                                                        • Opcode Fuzzy Hash: e8a2c195ee76dfd59a84a35b1cdf9e15a3b06e47dea4a5400648535d534bf17f
                                                                                        • Instruction Fuzzy Hash: F7F03030A00A19D2DB006FB1FE1A66F7AB5FBC0B43F920895E591A0084DFB58571838A
                                                                                        Function 004117D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(mscoree.dll,?,00411810,00411739,?,00418376,000000FF,0000001E,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004), ref: 004117E2
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004117F2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 1646373207-1276376045
                                                                                        • Opcode ID: a7685ab17104cc0c073debe12178e0060415aba7f1dae0483c91b0ec95b921c4
                                                                                        • Instruction ID: 6b29009f96e0e291b67a18ed51c26f61cb0bd4e92b549ae29e71b4d684277c2c
                                                                                        • Opcode Fuzzy Hash: a7685ab17104cc0c073debe12178e0060415aba7f1dae0483c91b0ec95b921c4
                                                                                        • Instruction Fuzzy Hash: 42D0C9302402096B9F247BB29D09A5F3A5EBE80B613248836BD28D2160DAAAC8408668
                                                                                        Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                        • API String ID: 2574300362-1816364905
                                                                                        • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                        • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                        • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                        • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                        Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,00000000,?,?,00000101,?,?), ref: 004343DE
                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: ICMP.DLL$IcmpSendEcho
                                                                                        • API String ID: 2574300362-58917771
                                                                                        • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                        • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                        • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                        • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                        Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                        • API String ID: 2574300362-3530519716
                                                                                        • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                        • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                        • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                        • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                        Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: ICMP.DLL$IcmpCreateFile
                                                                                        • API String ID: 2574300362-275556492
                                                                                        • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                        • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                        • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                        • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                        Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: IsWow64Process$kernel32.dll
                                                                                        • API String ID: 2574300362-3024904723
                                                                                        • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                        • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                        • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                        • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                        Function 0040EEE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,0040E5BF,?), ref: 0040EEEB
                                                                                        • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0040EEFD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryLoadProc
                                                                                        • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                        • API String ID: 2574300362-192647395
                                                                                        • Opcode ID: 58ac1dddc1eea1967b9e3df612208a50857473a21dbb81c427901d39c1ebcba1
                                                                                        • Instruction ID: 788ba9bdae5bc0ddad915f4d08bdcf590d5e3b2ea1e3da194f5c7121584c3133
                                                                                        • Opcode Fuzzy Hash: 58ac1dddc1eea1967b9e3df612208a50857473a21dbb81c427901d39c1ebcba1
                                                                                        • Instruction Fuzzy Hash: ABD0C9B0944703AAC7311F72C91C70A7AE4AB40341F204C3EB996E1691DBBCC0508B2C
                                                                                        Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClearVariant
                                                                                        • String ID:
                                                                                        • API String ID: 1473721057-0
                                                                                        • Opcode ID: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                        • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                        • Opcode Fuzzy Hash: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                                        • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                        Function 0047375F Relevance: 6.2, APIs: 4, Instructions: 150processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                        • String ID:
                                                                                        • API String ID: 420147892-0
                                                                                        • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                        • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                        • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                        • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                        Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                        • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                        • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 2286883814-0
                                                                                        • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                        • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                        • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                        • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                        Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                        • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                        • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                        • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                                                        • String ID:
                                                                                        • API String ID: 1352109105-0
                                                                                        • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                        • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                        • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                        • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                        Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                        • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                        • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                        • String ID:
                                                                                        • API String ID: 3321077145-0
                                                                                        • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                        • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                        • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                        • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                        Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetForegroundWindow.USER32 ref: 00472806
                                                                                          • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                          • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                          • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                        • GetCaretPos.USER32(?), ref: 0047281A
                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                        • GetForegroundWindow.USER32 ref: 0047285C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                        • String ID:
                                                                                        • API String ID: 2759813231-0
                                                                                        • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                        • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                        • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                        • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                        Function 0045552E Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                        • DestroyCursor.USER32(?), ref: 0045566A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteObject$CursorDestroyMoveWindow
                                                                                        • String ID:
                                                                                        • API String ID: 3883585953-0
                                                                                        • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                        • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                        • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                        • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                        Function 00445719 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsWindowVisible.USER32(?), ref: 00445721
                                                                                        • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                        • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                        • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2796087071-0
                                                                                        • Opcode ID: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                        • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                        • Opcode Fuzzy Hash: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                                        • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                        Function 00439326 Relevance: 6.1, APIs: 4, Instructions: 72processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                        • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                        • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
                                                                                        • String ID:
                                                                                        • API String ID: 2621361867-0
                                                                                        • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                        • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                        • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                        • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                        Function 00459DCF Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                        • GetForegroundWindow.USER32 ref: 00459E07
                                                                                        • 744DA3B0.USER32(00000000,?,00000000,00000000), ref: 00459E44
                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$ForegroundPixel
                                                                                        • String ID:
                                                                                        • API String ID: 3512272494-0
                                                                                        • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                        • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                        • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                        • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                        Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • select.WS2_32 ref: 0045890A
                                                                                        • __WSAFDIsSet.WS2_32(00000000,00000000), ref: 00458919
                                                                                        • accept.WS2_32(00000000,00000000,00000000), ref: 00458927
                                                                                        • WSAGetLastError.WS2_32(00000000), ref: 00458952
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastacceptselect
                                                                                        • String ID:
                                                                                        • API String ID: 385091864-0
                                                                                        • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                        • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                        • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                        • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                        Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 3850602802-0
                                                                                        • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                        • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                        • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                        • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                        Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                        • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$CreateMessageObjectSendShowStock
                                                                                        • String ID:
                                                                                        • API String ID: 1358664141-0
                                                                                        • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                        • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                        • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                        • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                        Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                        • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                        • String ID:
                                                                                        • API String ID: 2880819207-0
                                                                                        • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                        • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                        • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                        • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                        Function 0041A2B3 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlReAllocateHeap.NTDLL(00000000,-00000010,00000000,00000000), ref: 0041A2DA
                                                                                        • RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 0041A310
                                                                                        • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00411739,?,00401C0B), ref: 0041A32A
                                                                                        • HeapFree.KERNEL32(00000000,?,?,00411739,?,00401C0B), ref: 0041A341
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Heap$Allocate$AllocFreeVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 94566200-0
                                                                                        • Opcode ID: bc501b1f3452fb4555c1e7e86ad22a71cea65b8e1d754c6294030291da32ca1b
                                                                                        • Instruction ID: c0789fce48f3efc00023f82bc826da5228bc21048a08359dcc1a9c3791e9814b
                                                                                        • Opcode Fuzzy Hash: bc501b1f3452fb4555c1e7e86ad22a71cea65b8e1d754c6294030291da32ca1b
                                                                                        • Instruction Fuzzy Hash: AD119131604200AFC7214F28ED059567BB5F7597207214A7AF9A6D72F1D3759C828B58
                                                                                        Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                        • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                        • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                        • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClientRectScreen$InvalidateWindow
                                                                                        • String ID:
                                                                                        • API String ID: 357397906-0
                                                                                        • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                        • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                        • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                        • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                        Function 00455505 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                        • DestroyCursor.USER32(?), ref: 0045566A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteObject$CursorDestroyMessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 2743624342-0
                                                                                        • Opcode ID: 03326d37382ada86ec35a2455d9fa387f6dc407ad5e138ceea92d1b2708a23d2
                                                                                        • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                        • Opcode Fuzzy Hash: 03326d37382ada86ec35a2455d9fa387f6dc407ad5e138ceea92d1b2708a23d2
                                                                                        • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                        Function 004550EA Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteDestroyObject$CursorMenu
                                                                                        • String ID:
                                                                                        • API String ID: 1437398978-0
                                                                                        • Opcode ID: 877525a6e3370c5ccba41e297dc62c3db44fda5d828b2299b51e2ad73fa74798
                                                                                        • Instruction ID: 207b3bb3e25ad00a15c07b2f087c1785105d77cd6c96656ae7de419633222858
                                                                                        • Opcode Fuzzy Hash: 877525a6e3370c5ccba41e297dc62c3db44fda5d828b2299b51e2ad73fa74798
                                                                                        • Instruction Fuzzy Hash: AD011D742007419BDB10AF65EA98A2A77A8BB04322B40456AFD05D7252DB78EC498B69
                                                                                        Function 00455101 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteDestroyObject$CursorMenu
                                                                                        • String ID:
                                                                                        • API String ID: 1437398978-0
                                                                                        • Opcode ID: d60c490a6008197a0c21b786ff2f1e759a2fdb36e278f6b7cb76a42c0b1b1e7a
                                                                                        • Instruction ID: 2ae38aa05b286bb6bb18d128c1a0de451c885abaca08559cbc2512d540d63292
                                                                                        • Opcode Fuzzy Hash: d60c490a6008197a0c21b786ff2f1e759a2fdb36e278f6b7cb76a42c0b1b1e7a
                                                                                        • Instruction Fuzzy Hash: 87F03C702006419BCB20AF69EA98A2B77A8AB04322740496AFD05D7242DB79DC498B6C
                                                                                        Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlEnterCriticalSection.NTDLL(?), ref: 0044B60B
                                                                                        • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                        • RtlLeaveCriticalSection.NTDLL(?), ref: 0044B630
                                                                                        • RtlLeaveCriticalSection.NTDLL(?), ref: 0044B641
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                        • String ID:
                                                                                        • API String ID: 2223660684-0
                                                                                        • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                        • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                        • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                        • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                        Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                        • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                        • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                        • EndPath.GDI32(?), ref: 004472B0
                                                                                        • StrokePath.GDI32(?), ref: 004472BE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                        • String ID:
                                                                                        • API String ID: 2783949968-0
                                                                                        • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                        • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                        • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                        • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                        Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                        • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                        • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2710830443-0
                                                                                        • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                        • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                        • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                        • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                        Function 00466999 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 312COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • 75B8D5B0.COMDLG32(00000058), ref: 00466D9E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: X$HH
                                                                                        • API String ID: 0-1944015008
                                                                                        • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                        • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                        • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                        • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                        Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                          • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: CopyVariant$ContainedObject$ErrorLast
                                                                                        • String ID: AutoIt3GUI$Container
                                                                                        • API String ID: 4053020530-3941886329
                                                                                        • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                        • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                        • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                        • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                        Function 0045427D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 0045435B
                                                                                        • GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 00454371
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc
                                                                                        • String ID: AU3_FreeVar
                                                                                        • API String ID: 190572456-771828931
                                                                                        • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                        • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                        • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                        • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                        Function 004667A7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170shareCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Connection
                                                                                        • String ID: LPT$HH
                                                                                        • API String ID: 1722446006-2728063697
                                                                                        • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                        • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                        • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                        • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                        Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: HH$HH
                                                                                        • API String ID: 0-1787419579
                                                                                        • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                        • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                        • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                        • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                        Function 004509D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window
                                                                                        • String ID: 0DNt$SysTreeView32
                                                                                        • API String ID: 2353593579-115820117
                                                                                        • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                        • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                        • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                        • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                        Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: '
                                                                                        • API String ID: 3850602802-1997036262
                                                                                        • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                        • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                        • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                        • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                        Function 00450C09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: msctls_updown32
                                                                                        • API String ID: 0-2298589950
                                                                                        • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                        • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                        • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                        • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                        Function 00401BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                        • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: IconLoadNotifyShell_String
                                                                                        • String ID: Line:
                                                                                        • API String ID: 3363329723-1585850449
                                                                                        • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                        • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                        • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                        • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                        Function 004609BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                          • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                          • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                          • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                        • GetFocus.USER32 ref: 004609EF
                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Thread$Parent$AttachClassCurrentFocusInputMessageNameProcessSendTimeoutWindow
                                                                                        • String ID: %s%d
                                                                                        • API String ID: 3265199946-1110647743
                                                                                        • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                        • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                        • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                        • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                        Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                        • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: Combobox
                                                                                        • API String ID: 3850602802-2096851135
                                                                                        • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                        • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                        • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                        • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                        Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: LengthMessageSendTextWindow
                                                                                        • String ID: edit
                                                                                        • API String ID: 2978978980-2167791130
                                                                                        • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                        • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                        • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                        • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                        Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: GlobalMemorySleepStatus
                                                                                        • String ID: @
                                                                                        • API String ID: 2783356886-2766056989
                                                                                        • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                        • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                        • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                        • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                        Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: htonsinet_addr
                                                                                        • String ID: 255.255.255.255
                                                                                        • API String ID: 3832099526-2422070025
                                                                                        • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                        • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                        • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                        • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                        Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 3850602802-1403004172
                                                                                        • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                        • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                        • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                        • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                        Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: InternetOpen
                                                                                        • String ID: <local>
                                                                                        • API String ID: 2038078732-4266983199
                                                                                        • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                        • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                        • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                        • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                        Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 3850602802-1403004172
                                                                                        • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                        • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                        • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                        • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                        Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: ComboBox$ListBox
                                                                                        • API String ID: 3850602802-1403004172
                                                                                        • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                        • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                        • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                        • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                        Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                        • wsprintfW.USER32 ref: 004560E9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSendwsprintf
                                                                                        • String ID: %d/%02d/%02d
                                                                                        • API String ID: 3751067900-328681919
                                                                                        • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                        • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                        • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                        • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                        Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                        • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                        • String ID: Shell_TrayWnd
                                                                                        • API String ID: 529655941-2988720461
                                                                                        • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                        • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                        • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                        • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                        Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                        • PostMessageW.USER32(00000000), ref: 00442247
                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                        • String ID: Shell_TrayWnd
                                                                                        • API String ID: 529655941-2988720461
                                                                                        • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                        • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                        • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                        • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                        Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID: Message
                                                                                        • String ID: AutoIt$Error allocating memory.
                                                                                        • API String ID: 2030045667-4017498283
                                                                                        • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                        • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                        • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                        • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E
                                                                                        Function 00420F72 Relevance: 5.2, APIs: 4, Instructions: 158COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.71528186776.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.71528154362.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.0000000000490000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004A7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528186776.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528496391.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.71528528797.00000000004B9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Payment Advice.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: e21ebec6c319a3a06a3d53db755c2202487df8849f926ed45ddae3c3f438fce4
                                                                                        • Instruction ID: 58e65c1d3c9d5375c6c4846b495856b93fc864ff41b17a7244da1b02060b43b1
                                                                                        • Opcode Fuzzy Hash: e21ebec6c319a3a06a3d53db755c2202487df8849f926ed45ddae3c3f438fce4
                                                                                        • Instruction Fuzzy Hash: 2D511470A042A9AFCB209F64D9819BE7BB1EF11310BA0016FE5605B2B1D779CE81DB59