Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payment confirmaton copy.exe

Overview

General Information

Sample name:Payment confirmaton copy.exe
Analysis ID:1539392
MD5:7a025cb6d0132c24480c220a138a5ba0
SHA1:82bdb9179ada49f55fd24f3d11b9daae37960a54
SHA256:99f3663c5e2a888f0dcfb66d132da6327c53ca5957e56c1ed3ad9a8230fd4655
Tags:exeFormbookuser-threatcat_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • Payment confirmaton copy.exe (PID: 5572 cmdline: "C:\Users\user\Desktop\Payment confirmaton copy.exe" MD5: 7A025CB6D0132C24480C220A138A5BA0)
    • svchost.exe (PID: 2736 cmdline: "C:\Users\user\Desktop\Payment confirmaton copy.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c370:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x143df:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2f763:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x177d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      SourceRuleDescriptionAuthorStrings
      2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x2e963:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x169d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2f763:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x177d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

          System Summary

          barindex
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Payment confirmaton copy.exe", CommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", ParentImage: C:\Users\user\Desktop\Payment confirmaton copy.exe, ParentProcessId: 5572, ParentProcessName: Payment confirmaton copy.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", ProcessId: 2736, ProcessName: svchost.exe
          Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\Payment confirmaton copy.exe", CommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", ParentImage: C:\Users\user\Desktop\Payment confirmaton copy.exe, ParentProcessId: 5572, ParentProcessName: Payment confirmaton copy.exe, ProcessCommandLine: "C:\Users\user\Desktop\Payment confirmaton copy.exe", ProcessId: 2736, ProcessName: svchost.exe
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: Payment confirmaton copy.exeAvira: detected
          Source: Payment confirmaton copy.exeReversingLabs: Detection: 71%
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Source: Payment confirmaton copy.exeJoe Sandbox ML: detected
          Source: Payment confirmaton copy.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: Binary string: wntdll.pdbUGP source: Payment confirmaton copy.exe, 00000000.00000003.1625353072.0000000004700000.00000004.00001000.00020000.00000000.sdmp, Payment confirmaton copy.exe, 00000000.00000003.1624051666.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1788125238.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1786325794.0000000003300000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Payment confirmaton copy.exe, 00000000.00000003.1625353072.0000000004700000.00000004.00001000.00020000.00000000.sdmp, Payment confirmaton copy.exe, 00000000.00000003.1624051666.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1822340091.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1788125238.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1786325794.0000000003300000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

          E-Banking Fraud

          barindex
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: initial sampleStatic PE information: Filename: Payment confirmaton copy.exe
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C9F3 NtClose,2_2_0042C9F3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772B60 NtClose,LdrInitializeThunk,2_2_03772B60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03772DF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037735C0 NtCreateMutant,LdrInitializeThunk,2_2_037735C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03774340 NtSetContextThread,2_2_03774340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03774650 NtSuspendThread,2_2_03774650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772BF0 NtAllocateVirtualMemory,2_2_03772BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772BE0 NtQueryValueKey,2_2_03772BE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772BA0 NtEnumerateValueKey,2_2_03772BA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772B80 NtQueryInformationFile,2_2_03772B80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772AF0 NtWriteFile,2_2_03772AF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772AD0 NtReadFile,2_2_03772AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772AB0 NtWaitForSingleObject,2_2_03772AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772F60 NtCreateProcessEx,2_2_03772F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772F30 NtCreateSection,2_2_03772F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772FE0 NtCreateFile,2_2_03772FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772FB0 NtResumeThread,2_2_03772FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772FA0 NtQuerySection,2_2_03772FA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772F90 NtProtectVirtualMemory,2_2_03772F90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772E30 NtWriteVirtualMemory,2_2_03772E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772EE0 NtQueueApcThread,2_2_03772EE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772EA0 NtAdjustPrivilegesToken,2_2_03772EA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772E80 NtReadVirtualMemory,2_2_03772E80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772D30 NtUnmapViewOfSection,2_2_03772D30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772D10 NtMapViewOfSection,2_2_03772D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772D00 NtSetInformationFile,2_2_03772D00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772DD0 NtDelayExecution,2_2_03772DD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772DB0 NtEnumerateKey,2_2_03772DB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772C70 NtFreeVirtualMemory,2_2_03772C70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772C60 NtCreateKey,2_2_03772C60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772C00 NtQueryInformationProcess,2_2_03772C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772CF0 NtOpenProcess,2_2_03772CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772CC0 NtQueryVirtualMemory,2_2_03772CC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772CA0 NtQueryInformationToken,2_2_03772CA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03773010 NtOpenDirectoryObject,2_2_03773010
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03773090 NtSetValueKey,2_2_03773090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037739B0 NtGetContextThread,2_2_037739B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03773D70 NtOpenThread,2_2_03773D70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03773D10 NtOpenProcessToken,2_2_03773D10
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00409A400_2_00409A40
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004120380_2_00412038
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004271610_2_00427161
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0047E1FA0_2_0047E1FA
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004212BE0_2_004212BE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004433900_2_00443390
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004433910_2_00443391
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0041A46B0_2_0041A46B
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0041240C0_2_0041240C
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004465660_2_00446566
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004045E00_2_004045E0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0041D7500_2_0041D750
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004037E00_2_004037E0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004278590_2_00427859
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004128180_2_00412818
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040F8900_2_0040F890
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0042397B0_2_0042397B
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00411B630_2_00411B63
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0047CBF00_2_0047CBF0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044EBBC0_2_0044EBBC
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00412C380_2_00412C38
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044ED9A0_2_0044ED9A
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00423EBF0_2_00423EBF
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00424F700_2_00424F70
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0041AF0D0_2_0041AF0D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0400D6580_2_0400D658
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042F0532_2_0042F053
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004028582_2_00402858
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004028602_2_00402860
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004031702_2_00403170
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041017B2_2_0041017B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004101832_2_00410183
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011902_2_00401190
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416B432_2_00416B43
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416B3E2_2_00416B3E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004023D02_2_004023D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004103A32_2_004103A3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004014702_2_00401470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E4232_2_0040E423
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004025402_2_00402540
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004025392_2_00402539
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FA3522_2_037FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038003E62_2_038003E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E3F02_2_0374E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E02742_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C02C02_2_037C02C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C81582_2_037C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038001AA2_2_038001AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DA1182_2_037DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037301002_2_03730100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F81CC2_2_037F81CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D20002_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037407702_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037647502_2_03764750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373C7C02_2_0373C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375C6E02_2_0375C6E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038005912_2_03800591
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037405352_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F24462_2_037F2446
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E44202_2_037E4420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EE4F62_2_037EE4F6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FAB402_2_037FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F6BD72_2_037F6BD7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA802_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037569622_2_03756962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380A9A62_2_0380A9A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A02_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374A8402_2_0374A840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037428402_2_03742840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E8F02_2_0376E8F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037268B82_2_037268B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B4F402_2_037B4F40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03760F302_2_03760F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E2F302_2_037E2F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03782F282_2_03782F28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374CFE02_2_0374CFE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03732FC82_2_03732FC8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BEFA02_2_037BEFA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740E592_2_03740E59
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FEE262_2_037FEE26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FEEDB2_2_037FEEDB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752E902_2_03752E90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FCE932_2_037FCE93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DCD1F2_2_037DCD1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374AD002_2_0374AD00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373ADE02_2_0373ADE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03758DBF2_2_03758DBF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740C002_2_03740C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730CF22_2_03730CF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0CB52_2_037E0CB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372D34C2_2_0372D34C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F132D2_2_037F132D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0378739A2_2_0378739A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E12ED2_2_037E12ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375B2C02_2_0375B2C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037452A02_2_037452A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372F1722_2_0372F172
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377516C2_2_0377516C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374B1B02_2_0374B1B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380B16B2_2_0380B16B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F70E92_2_037F70E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FF0E02_2_037FF0E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EF0CC2_2_037EF0CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037470C02_2_037470C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FF7B02_2_037FF7B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F16CC2_2_037F16CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F75712_2_037F7571
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DD5B02_2_037DD5B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037314602_2_03731460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FF43F2_2_037FF43F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FFB762_2_037FFB76
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B5BF02_2_037B5BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377DBF92_2_0377DBF9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375FB802_2_0375FB80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B3A6C2_2_037B3A6C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FFA492_2_037FFA49
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F7A462_2_037F7A46
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EDAC62_2_037EDAC6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DDAAC2_2_037DDAAC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03785AA02_2_03785AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E1AA32_2_037E1AA3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037499502_2_03749950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375B9502_2_0375B950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D59102_2_037D5910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AD8002_2_037AD800
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037438E02_2_037438E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FFF092_2_037FFF09
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03703FD22_2_03703FD2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03703FD52_2_03703FD5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FFFB12_2_037FFFB1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03741F922_2_03741F92
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03749EB02_2_03749EB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F7D732_2_037F7D73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F1D5A2_2_037F1D5A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03743D402_2_03743D40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375FDC02_2_0375FDC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B9C322_2_037B9C32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FFCF22_2_037FFCF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03787E54 appears 102 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 037BF290 appears 105 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03775130 appears 58 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0372B970 appears 278 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 037AEA12 appears 86 times
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: String function: 00445975 appears 65 times
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: String function: 0041171A appears 37 times
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: String function: 0041718C appears 45 times
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: String function: 0040E6D0 appears 35 times
          Source: Payment confirmaton copy.exe, 00000000.00000003.1623478907.00000000049CD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment confirmaton copy.exe
          Source: Payment confirmaton copy.exe, 00000000.00000003.1625353072.0000000004823000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment confirmaton copy.exe
          Source: Payment confirmaton copy.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeFile created: C:\Users\user\AppData\Local\Temp\ghautsJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCommand line argument: Wu0_2_0040D7F0
          Source: Payment confirmaton copy.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Payment confirmaton copy.exeReversingLabs: Detection: 71%
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeFile read: C:\Users\user\Desktop\Payment confirmaton copy.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\Payment confirmaton copy.exe "C:\Users\user\Desktop\Payment confirmaton copy.exe"
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment confirmaton copy.exe"
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment confirmaton copy.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
          Source: Payment confirmaton copy.exeStatic file information: File size 1332351 > 1048576
          Source: Binary string: wntdll.pdbUGP source: Payment confirmaton copy.exe, 00000000.00000003.1625353072.0000000004700000.00000004.00001000.00020000.00000000.sdmp, Payment confirmaton copy.exe, 00000000.00000003.1624051666.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1788125238.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1786325794.0000000003300000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Payment confirmaton copy.exe, 00000000.00000003.1625353072.0000000004700000.00000004.00001000.00020000.00000000.sdmp, Payment confirmaton copy.exe, 00000000.00000003.1624051666.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1822340091.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1822340091.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1788125238.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1786325794.0000000003300000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
          Source: Payment confirmaton copy.exeStatic PE information: real checksum: 0xa2135 should be: 0x14ea95
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040C15B push 00000006h; iretd 2_2_0040C15D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414193 push ss; ret 2_2_00414194
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004159A1 push 35D13253h; ret 2_2_004159A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00408A24 push esi; retf 2_2_00408A26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00412379 push ebx; retf 2_2_0041238C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040531A pushad ; ret 2_2_0040532C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004033F0 push eax; ret 2_2_004033F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A4CE push cs; retf 2_2_0041A4D2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404CAF push ebp; iretd 2_2_00404CBC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411EC2 push 00000018h; ret 2_2_00411ED8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404EA1 push es; ret 2_2_00404EA2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370225F pushad ; ret 2_2_037027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037027FA pushad ; ret 2_2_037027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037309AD push ecx; mov dword ptr [esp], ecx2_2_037309B6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370283D push eax; iretd 2_2_03702858
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004440780_2_00444078
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeAPI/Special instruction interceptor: Address: 400D27C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377096E rdtsc 2_2_0377096E
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeAPI coverage: 3.2 %
          Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
          Source: C:\Windows\SysWOW64\svchost.exe TID: 1912Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377096E rdtsc 2_2_0377096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417AF3 LdrLoadDll,2_2_00417AF3
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0400D4E8 mov eax, dword ptr fs:[00000030h]0_2_0400D4E8
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0400D548 mov eax, dword ptr fs:[00000030h]0_2_0400D548
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0400BED8 mov eax, dword ptr fs:[00000030h]0_2_0400BED8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D437C mov eax, dword ptr fs:[00000030h]2_2_037D437C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov ecx, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]2_2_037B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FA352 mov eax, dword ptr fs:[00000030h]2_2_037FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D8350 mov ecx, dword ptr fs:[00000030h]2_2_037D8350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]2_2_037B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372C310 mov ecx, dword ptr fs:[00000030h]2_2_0372C310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03750310 mov ecx, dword ptr fs:[00000030h]2_2_03750310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]2_2_0376A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]2_2_0376A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]2_2_0376A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]2_2_0374E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]2_2_0374E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]2_2_0374E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037663FF mov eax, dword ptr fs:[00000030h]2_2_037663FF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]2_2_037403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]2_2_037DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]2_2_037DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE3DB mov ecx, dword ptr fs:[00000030h]2_2_037DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]2_2_037DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]2_2_037D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]2_2_037D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EC3CD mov eax, dword ptr fs:[00000030h]2_2_037EC3CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]2_2_0373A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]2_2_037383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]2_2_037383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]2_2_037383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]2_2_037383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B63C0 mov eax, dword ptr fs:[00000030h]2_2_037B63C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]2_2_03728397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]2_2_03728397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]2_2_03728397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]2_2_0372E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]2_2_0372E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]2_2_0372E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]2_2_0375438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]2_2_0375438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]2_2_037E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]2_2_03734260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]2_2_03734260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]2_2_03734260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372826B mov eax, dword ptr fs:[00000030h]2_2_0372826B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A250 mov eax, dword ptr fs:[00000030h]2_2_0372A250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736259 mov eax, dword ptr fs:[00000030h]2_2_03736259
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B8243 mov eax, dword ptr fs:[00000030h]2_2_037B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B8243 mov ecx, dword ptr fs:[00000030h]2_2_037B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372823B mov eax, dword ptr fs:[00000030h]2_2_0372823B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]2_2_037402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]2_2_037402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]2_2_037402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]2_2_0373A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]2_2_0373A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]2_2_0373A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]2_2_0373A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]2_2_0373A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]2_2_037402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]2_2_037402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov ecx, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]2_2_037C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]2_2_0376E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]2_2_0376E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]2_2_037B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]2_2_037B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]2_2_037B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372C156 mov eax, dword ptr fs:[00000030h]2_2_0372C156
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C8158 mov eax, dword ptr fs:[00000030h]2_2_037C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]2_2_03736154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]2_2_03736154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]2_2_037C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]2_2_037C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C4144 mov ecx, dword ptr fs:[00000030h]2_2_037C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]2_2_037C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]2_2_037C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03760124 mov eax, dword ptr fs:[00000030h]2_2_03760124
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DA118 mov ecx, dword ptr fs:[00000030h]2_2_037DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]2_2_037DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]2_2_037DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]2_2_037DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038061E5 mov eax, dword ptr fs:[00000030h]2_2_038061E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F0115 mov eax, dword ptr fs:[00000030h]2_2_037F0115
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]2_2_037DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037601F8 mov eax, dword ptr fs:[00000030h]2_2_037601F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]2_2_037AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]2_2_037AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_037AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]2_2_037AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]2_2_037AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]2_2_037F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]2_2_037F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]2_2_037B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]2_2_037B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]2_2_037B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]2_2_037B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]2_2_0372A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]2_2_0372A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]2_2_0372A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03770185 mov eax, dword ptr fs:[00000030h]2_2_03770185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]2_2_037EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]2_2_037EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]2_2_037D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]2_2_037D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375C073 mov eax, dword ptr fs:[00000030h]2_2_0375C073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03732050 mov eax, dword ptr fs:[00000030h]2_2_03732050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6050 mov eax, dword ptr fs:[00000030h]2_2_037B6050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6030 mov eax, dword ptr fs:[00000030h]2_2_037C6030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A020 mov eax, dword ptr fs:[00000030h]2_2_0372A020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372C020 mov eax, dword ptr fs:[00000030h]2_2_0372C020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]2_2_0374E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]2_2_0374E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]2_2_0374E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]2_2_0374E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B4000 mov ecx, dword ptr fs:[00000030h]2_2_037B4000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]2_2_037D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372C0F0 mov eax, dword ptr fs:[00000030h]2_2_0372C0F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037720F0 mov ecx, dword ptr fs:[00000030h]2_2_037720F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0372A0E3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037380E9 mov eax, dword ptr fs:[00000030h]2_2_037380E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B60E0 mov eax, dword ptr fs:[00000030h]2_2_037B60E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B20DE mov eax, dword ptr fs:[00000030h]2_2_037B20DE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F60B8 mov eax, dword ptr fs:[00000030h]2_2_037F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F60B8 mov ecx, dword ptr fs:[00000030h]2_2_037F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C80A8 mov eax, dword ptr fs:[00000030h]2_2_037C80A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373208A mov eax, dword ptr fs:[00000030h]2_2_0373208A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738770 mov eax, dword ptr fs:[00000030h]2_2_03738770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]2_2_03740770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730750 mov eax, dword ptr fs:[00000030h]2_2_03730750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BE75D mov eax, dword ptr fs:[00000030h]2_2_037BE75D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]2_2_03772750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]2_2_03772750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B4755 mov eax, dword ptr fs:[00000030h]2_2_037B4755
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376674D mov esi, dword ptr fs:[00000030h]2_2_0376674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]2_2_0376674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]2_2_0376674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]2_2_0376273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376273C mov ecx, dword ptr fs:[00000030h]2_2_0376273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]2_2_0376273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AC730 mov eax, dword ptr fs:[00000030h]2_2_037AC730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]2_2_0376C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]2_2_0376C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730710 mov eax, dword ptr fs:[00000030h]2_2_03730710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03760710 mov eax, dword ptr fs:[00000030h]2_2_03760710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C700 mov eax, dword ptr fs:[00000030h]2_2_0376C700
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]2_2_037347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]2_2_037347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]2_2_037527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]2_2_037527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]2_2_037527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BE7E1 mov eax, dword ptr fs:[00000030h]2_2_037BE7E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373C7C0 mov eax, dword ptr fs:[00000030h]2_2_0373C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B07C3 mov eax, dword ptr fs:[00000030h]2_2_037B07C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037307AF mov eax, dword ptr fs:[00000030h]2_2_037307AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E47A0 mov eax, dword ptr fs:[00000030h]2_2_037E47A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D678E mov eax, dword ptr fs:[00000030h]2_2_037D678E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03762674 mov eax, dword ptr fs:[00000030h]2_2_03762674
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]2_2_037F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]2_2_037F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]2_2_0376A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]2_2_0376A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374C640 mov eax, dword ptr fs:[00000030h]2_2_0374C640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374E627 mov eax, dword ptr fs:[00000030h]2_2_0374E627
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03766620 mov eax, dword ptr fs:[00000030h]2_2_03766620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03768620 mov eax, dword ptr fs:[00000030h]2_2_03768620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373262C mov eax, dword ptr fs:[00000030h]2_2_0373262C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03772619 mov eax, dword ptr fs:[00000030h]2_2_03772619
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE609 mov eax, dword ptr fs:[00000030h]2_2_037AE609
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]2_2_0374260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]2_2_037AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]2_2_037AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]2_2_037AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]2_2_037AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]2_2_037B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]2_2_037B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0376A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A6C7 mov eax, dword ptr fs:[00000030h]2_2_0376A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037666B0 mov eax, dword ptr fs:[00000030h]2_2_037666B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C6A6 mov eax, dword ptr fs:[00000030h]2_2_0376C6A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]2_2_03734690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]2_2_03734690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]2_2_0376656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]2_2_0376656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]2_2_0376656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]2_2_03738550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]2_2_03738550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]2_2_03740535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]2_2_0375E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]2_2_0375E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]2_2_0375E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]2_2_0375E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]2_2_0375E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6500 mov eax, dword ptr fs:[00000030h]2_2_037C6500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]2_2_03804500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]2_2_0375E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037325E0 mov eax, dword ptr fs:[00000030h]2_2_037325E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]2_2_0376C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]2_2_0376C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037365D0 mov eax, dword ptr fs:[00000030h]2_2_037365D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]2_2_0376A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]2_2_0376A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]2_2_0376E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]2_2_0376E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]2_2_037545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]2_2_037545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]2_2_037B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]2_2_037B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]2_2_037B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E59C mov eax, dword ptr fs:[00000030h]2_2_0376E59C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03732582 mov eax, dword ptr fs:[00000030h]2_2_03732582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03732582 mov ecx, dword ptr fs:[00000030h]2_2_03732582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03764588 mov eax, dword ptr fs:[00000030h]2_2_03764588
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]2_2_0375A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]2_2_0375A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]2_2_0375A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BC460 mov ecx, dword ptr fs:[00000030h]2_2_037BC460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372645D mov eax, dword ptr fs:[00000030h]2_2_0372645D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375245A mov eax, dword ptr fs:[00000030h]2_2_0375245A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]2_2_0376E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A430 mov eax, dword ptr fs:[00000030h]2_2_0376A430
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]2_2_0372E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]2_2_0372E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]2_2_0372E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372C427 mov eax, dword ptr fs:[00000030h]2_2_0372C427
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]2_2_037B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]2_2_03768402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]2_2_03768402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]2_2_03768402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037304E5 mov ecx, dword ptr fs:[00000030h]2_2_037304E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037644B0 mov ecx, dword ptr fs:[00000030h]2_2_037644B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BA4B0 mov eax, dword ptr fs:[00000030h]2_2_037BA4B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037364AB mov eax, dword ptr fs:[00000030h]2_2_037364AB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372CB7E mov eax, dword ptr fs:[00000030h]2_2_0372CB7E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DEB50 mov eax, dword ptr fs:[00000030h]2_2_037DEB50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]2_2_037E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]2_2_037E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]2_2_037C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]2_2_037C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FAB40 mov eax, dword ptr fs:[00000030h]2_2_037FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D8B42 mov eax, dword ptr fs:[00000030h]2_2_037D8B42
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]2_2_0375EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]2_2_0375EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]2_2_037F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]2_2_037F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]2_2_037AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]2_2_03738BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]2_2_03738BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]2_2_03738BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375EBFC mov eax, dword ptr fs:[00000030h]2_2_0375EBFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BCBF0 mov eax, dword ptr fs:[00000030h]2_2_037BCBF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DEBD0 mov eax, dword ptr fs:[00000030h]2_2_037DEBD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]2_2_03750BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]2_2_03750BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]2_2_03750BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]2_2_03730BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]2_2_03730BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]2_2_03730BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]2_2_03740BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]2_2_03740BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]2_2_037E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]2_2_037E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03804A80 mov eax, dword ptr fs:[00000030h]2_2_03804A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]2_2_037ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]2_2_037ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]2_2_0376CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]2_2_0376CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]2_2_0376CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037DEA60 mov eax, dword ptr fs:[00000030h]2_2_037DEA60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]2_2_03736A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]2_2_03740A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]2_2_03740A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]2_2_03754A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]2_2_03754A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376CA38 mov eax, dword ptr fs:[00000030h]2_2_0376CA38
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376CA24 mov eax, dword ptr fs:[00000030h]2_2_0376CA24
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375EA2E mov eax, dword ptr fs:[00000030h]2_2_0375EA2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BCA11 mov eax, dword ptr fs:[00000030h]2_2_037BCA11
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]2_2_0376AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]2_2_0376AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730AD0 mov eax, dword ptr fs:[00000030h]2_2_03730AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]2_2_03764AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]2_2_03764AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]2_2_03786ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]2_2_03786ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]2_2_03786ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]2_2_03738AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]2_2_03738AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03786AA4 mov eax, dword ptr fs:[00000030h]2_2_03786AA4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03768A90 mov edx, dword ptr fs:[00000030h]2_2_03768A90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]2_2_0373EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]2_2_037D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]2_2_037D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BC97C mov eax, dword ptr fs:[00000030h]2_2_037BC97C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]2_2_03756962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]2_2_03756962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]2_2_03756962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]2_2_0377096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377096E mov edx, dword ptr fs:[00000030h]2_2_0377096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]2_2_0377096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B0946 mov eax, dword ptr fs:[00000030h]2_2_037B0946
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B892A mov eax, dword ptr fs:[00000030h]2_2_037B892A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C892B mov eax, dword ptr fs:[00000030h]2_2_037C892B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BC912 mov eax, dword ptr fs:[00000030h]2_2_037BC912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]2_2_03728918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]2_2_03728918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]2_2_037AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]2_2_037AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]2_2_037629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]2_2_037629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BE9E0 mov eax, dword ptr fs:[00000030h]2_2_037BE9E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]2_2_0373A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037649D0 mov eax, dword ptr fs:[00000030h]2_2_037649D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FA9D3 mov eax, dword ptr fs:[00000030h]2_2_037FA9D3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C69C0 mov eax, dword ptr fs:[00000030h]2_2_037C69C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B89B3 mov esi, dword ptr fs:[00000030h]2_2_037B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]2_2_037B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]2_2_037B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]2_2_037429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]2_2_037309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]2_2_037309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]2_2_037BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]2_2_037BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]2_2_037C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]2_2_037C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03760854 mov eax, dword ptr fs:[00000030h]2_2_03760854
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]2_2_03734859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]2_2_03734859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03742840 mov ecx, dword ptr fs:[00000030h]2_2_03742840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov ecx, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]2_2_03752835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376A830 mov eax, dword ptr fs:[00000030h]2_2_0376A830
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]2_2_037D483A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]2_2_037D483A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BC810 mov eax, dword ptr fs:[00000030h]2_2_037BC810
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]2_2_0376C8F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]2_2_0376C8F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037FA8E4 mov eax, dword ptr fs:[00000030h]2_2_037FA8E4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375E8C0 mov eax, dword ptr fs:[00000030h]2_2_0375E8C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037BC89D mov eax, dword ptr fs:[00000030h]2_2_037BC89D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03730887 mov eax, dword ptr fs:[00000030h]2_2_03730887
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]2_2_0375AF69
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]2_2_0375AF69
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]2_2_037D2F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]2_2_037D2F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]2_2_0372CF50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]2_2_0372CF50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]2_2_0372CF50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]2_2_0372CF50
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2C35008Jump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payment confirmaton copy.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
          Source: Payment confirmaton copy.exeBinary or memory string: Shell_TrayWnd
          Source: Payment confirmaton copy.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Payment confirmaton copy.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
          Source: Payment confirmaton copy.exeBinary or memory string: WIN_XP
          Source: Payment confirmaton copy.exeBinary or memory string: WIN_XPe
          Source: Payment confirmaton copy.exeBinary or memory string: WIN_VISTA
          Source: Payment confirmaton copy.exeBinary or memory string: WIN_7

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
          Source: C:\Users\user\Desktop\Payment confirmaton copy.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts
          1
          Native API
          1
          DLL Side-Loading
          1
          Exploitation for Privilege Escalation
          1
          Disable or Modify Tools
          21
          Input Capture
          2
          System Time Discovery
          Remote Services1
          Archive Collected Data
          1
          Ingress Tool Transfer
          Exfiltration Over Other Network Medium1
          System Shutdown/Reboot
          CredentialsDomainsDefault Accounts2
          Command and Scripting Interpreter
          2
          Valid Accounts
          1
          DLL Side-Loading
          1
          Deobfuscate/Decode Files or Information
          LSASS Memory1
          Account Discovery
          Remote Desktop Protocol21
          Input Capture
          1
          Encrypted Channel
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
          Valid Accounts
          2
          Obfuscated Files or Information
          Security Account Manager2
          File and Directory Discovery
          SMB/Windows Admin Shares3
          Clipboard Data
          SteganographyAutomated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
          Access Token Manipulation
          1
          DLL Side-Loading
          NTDS115
          System Information Discovery
          Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script212
          Process Injection
          2
          Valid Accounts
          LSA Secrets24
          Security Software Discovery
          SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Virtualization/Sandbox Evasion
          Cached Domain Credentials2
          Virtualization/Sandbox Evasion
          VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
          Access Token Manipulation
          DCSync3
          Process Discovery
          Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job212
          Process Injection
          Proc Filesystem1
          Application Window Discovery
          Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
          System Owner/User Discovery
          Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          Payment confirmaton copy.exe71%ReversingLabsWin32.Trojan.Autoitinject
          Payment confirmaton copy.exe100%AviraTR/AD.Swotter.giycf
          Payment confirmaton copy.exe100%Joe Sandbox ML
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          NameIPActiveMaliciousAntivirus DetectionReputation
          s-part-0017.t-0009.fb-t-msedge.net
          13.107.253.45
          truefalse
            unknown
            No contacted IP infos
            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1539392
            Start date and time:2024-10-22 16:10:41 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 5m 37s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:6
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:Payment confirmaton copy.exe
            Detection:MAL
            Classification:mal100.troj.evad.winEXE@3/1@0/0
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 97%
            • Number of executed functions: 43
            • Number of non-executed functions: 307
            Cookbook Comments:
            • Found application associated with file extension: .exe
            • Stop behavior analysis, all processes terminated
            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
            • Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
            • Not all processes where analyzed, report is missing behavior information
            • Report size exceeded maximum capacity and may have missing disassembly code.
            • VT rate limit hit for: Payment confirmaton copy.exe
            TimeTypeDescription
            10:12:15API Interceptor3x Sleep call for process: svchost.exe modified
            No context
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            s-part-0017.t-0009.fb-t-msedge.nettop_25_domains.xlsGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            Document.xla.xlsxGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            https://docs.google.com/uc?export=download&id=11b8oashSjmYX6PpCmq4Ua9vnLHY-uAgUGet hashmaliciousHTMLPhisherBrowse
            • 13.107.253.45
            PPM435679.xlsGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            DHL.exeGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            Purchase order.xlsGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            Tax Returns Of R38,765.jsGet hashmaliciousSTRRATBrowse
            • 13.107.253.45
            Message_2533705.emlGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSOGet hashmaliciousUnknownBrowse
            • 13.107.253.45
            https://eu-chervongroup.powerappsportalsecurefiles.xyz/Get hashmaliciousHtmlDropperBrowse
            • 13.107.253.45
            No context
            No context
            No context
            Process:C:\Users\user\Desktop\Payment confirmaton copy.exe
            File Type:data
            Category:dropped
            Size (bytes):289280
            Entropy (8bit):7.994980416282204
            Encrypted:true
            SSDEEP:6144:LB7bBvNHgznExQHoev621s/lHwCtNRyyvfV+H44M19/y7JfOG+cxbqXXd:LB7XAnExPev9s9FJyY6M16YLclqXXd
            MD5:77294D76B5B876F7F571172B54A023E6
            SHA1:C4CC021DDD74DA9F67BC68F1184BFC8CD4AE4415
            SHA-256:59ACFF7820374B1C809E600D22521FF75FB5A679D77812751A7C15EF9F0960EB
            SHA-512:F131672C3E023910C2A74A49855E734E0AC152679BFF3650452C93AD9A183BCAFAF865DBE54A766BDFFC8D62CF36B57C340517C3B5DFD72D0D6EA530D9B3602C
            Malicious:false
            Reputation:low
            Preview:.lsk.58VR..M.....65....UZ...DLF2U7A669958VRXEXDLF2U7A66995.VRXKG.BF.\.`.7u..l>;+e(6#!@4ZaUWWWZLv0=e*1"f[;..ye.TZ\3|UHR`LF2U7A6O80..65.x8#.{R2.[....U_.H..x,!.O....Y^.j?10x8#.F2U7A669ip8V.YDXox.gU7A66995.VPYNYOLFjQ7A669958V"LEXD\F2UGE669y58FRXEZDL@2U7A669?58VRXEXD<B2U5A66995:V..EXTLF"U7A6&99%8VRXEXTLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7oBSAM58V..AXD\F2UoE66)958VRXEXDLF2U7a66Y958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRXEXDLF2U7A669958VRX
            File type:PE32 executable (GUI) Intel 80386, for MS Windows
            Entropy (8bit):7.492245733538812
            TrID:
            • Win32 Executable (generic) a (10002005/4) 95.11%
            • AutoIt3 compiled script executable (510682/80) 4.86%
            • Generic Win/DOS Executable (2004/3) 0.02%
            • DOS Executable Generic (2002/1) 0.02%
            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
            File name:Payment confirmaton copy.exe
            File size:1'332'351 bytes
            MD5:7a025cb6d0132c24480c220a138a5ba0
            SHA1:82bdb9179ada49f55fd24f3d11b9daae37960a54
            SHA256:99f3663c5e2a888f0dcfb66d132da6327c53ca5957e56c1ed3ad9a8230fd4655
            SHA512:0e132c3ee6652f6d243649a9f78b295a5f3f0e5e53f5d9f1f5aa27f9037554eea570d18393a0f79745e94ab8e623e8e3662e0c3a56bc6a03f291f07fdbeaf1e5
            SSDEEP:24576:TfmMv6Ckr7Mny5QUUWaCqFpuqctJEuv4iVlHbddZg:T3v+7/5QUVoFMzJES4Sl7Zg
            TLSH:DB55E152B3C680B5D9A33971293BE32AEB357D194326C48B97E13E729F311405B3B762
            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........
            Icon Hash:4cb1b19190919191
            Entrypoint:0x416310
            Entrypoint Section:.text
            Digitally signed:false
            Imagebase:0x400000
            Subsystem:windows gui
            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            DLL Characteristics:TERMINAL_SERVER_AWARE
            Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:5
            OS Version Minor:0
            File Version Major:5
            File Version Minor:0
            Subsystem Version Major:5
            Subsystem Version Minor:0
            Import Hash:aaaa8913c89c8aa4a5d93f06853894da
            Instruction
            call 00007FC508EAA09Ch
            jmp 00007FC508E9DE6Eh
            int3
            int3
            int3
            int3
            int3
            int3
            push ebp
            mov ebp, esp
            push edi
            push esi
            mov esi, dword ptr [ebp+0Ch]
            mov ecx, dword ptr [ebp+10h]
            mov edi, dword ptr [ebp+08h]
            mov eax, ecx
            mov edx, ecx
            add eax, esi
            cmp edi, esi
            jbe 00007FC508E9DFFAh
            cmp edi, eax
            jc 00007FC508E9E19Ah
            cmp ecx, 00000100h
            jc 00007FC508E9E011h
            cmp dword ptr [004A94E0h], 00000000h
            je 00007FC508E9E008h
            push edi
            push esi
            and edi, 0Fh
            and esi, 0Fh
            cmp edi, esi
            pop esi
            pop edi
            jne 00007FC508E9DFFAh
            pop esi
            pop edi
            pop ebp
            jmp 00007FC508E9E45Ah
            test edi, 00000003h
            jne 00007FC508E9E007h
            shr ecx, 02h
            and edx, 03h
            cmp ecx, 08h
            jc 00007FC508E9E01Ch
            rep movsd
            jmp dword ptr [00416494h+edx*4]
            nop
            mov eax, edi
            mov edx, 00000003h
            sub ecx, 04h
            jc 00007FC508E9DFFEh
            and eax, 03h
            add ecx, eax
            jmp dword ptr [004163A8h+eax*4]
            jmp dword ptr [004164A4h+ecx*4]
            nop
            jmp dword ptr [00416428h+ecx*4]
            nop
            mov eax, E4004163h
            arpl word ptr [ecx+00h], ax
            or byte ptr [ecx+eax*2+00h], ah
            and edx, ecx
            mov al, byte ptr [esi]
            mov byte ptr [edi], al
            mov al, byte ptr [esi+01h]
            mov byte ptr [edi+01h], al
            mov al, byte ptr [esi+02h]
            shr ecx, 02h
            mov byte ptr [edi+02h], al
            add esi, 03h
            add edi, 03h
            cmp ecx, 08h
            jc 00007FC508E9DFBEh
            Programming Language:
            • [ASM] VS2008 SP1 build 30729
            • [ C ] VS2008 SP1 build 30729
            • [C++] VS2008 SP1 build 30729
            • [ C ] VS2005 build 50727
            • [IMP] VS2005 build 50727
            • [ASM] VS2008 build 21022
            • [RES] VS2008 build 21022
            • [LNK] VS2008 SP1 build 30729
            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
            IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000xb620.rsrc
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
            .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
            .rsrc0xab0000xb6200xb800d740c2d675765e5a423ec15e09db3d5fFalse0.2766007133152174data4.2419136361238605IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            NameRVASizeTypeLanguageCountryZLIB Complexity
            RT_ICON0xab5080x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
            RT_ICON0xab6300x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
            RT_ICON0xab7580x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
            RT_ICON0xab8800x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.44060283687943264
            RT_ICON0xabce80x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishGreat Britain0.3848360655737705
            RT_ICON0xac6700x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.34709193245778613
            RT_ICON0xad7180x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.2949170124481328
            RT_ICON0xafcc00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishGreat Britain0.23730514879546527
            RT_MENU0xb3ee80x50dataEnglishGreat Britain0.9
            RT_DIALOG0xb3f380xfcdataEnglishGreat Britain0.6507936507936508
            RT_STRING0xb40380x530dataEnglishGreat Britain0.33960843373493976
            RT_STRING0xb45680x690dataEnglishGreat Britain0.26964285714285713
            RT_STRING0xb4bf80x43adataEnglishGreat Britain0.3733826247689464
            RT_STRING0xb50380x5fcdataEnglishGreat Britain0.3087467362924282
            RT_STRING0xb56380x65cdataEnglishGreat Britain0.34336609336609336
            RT_STRING0xb5c980x388dataEnglishGreat Britain0.377212389380531
            RT_STRING0xb60200x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
            RT_GROUP_ICON0xb61780x4cdataEnglishGreat Britain0.8157894736842105
            RT_GROUP_ICON0xb61c80x14dataEnglishGreat Britain1.15
            RT_GROUP_ICON0xb61e00x14dataEnglishGreat Britain1.25
            RT_GROUP_ICON0xb61f80x14dataEnglishGreat Britain1.25
            RT_VERSION0xb62100x19cdataEnglishGreat Britain0.5339805825242718
            RT_MANIFEST0xb63b00x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581
            DLLImport
            WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
            VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
            WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
            COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
            MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
            WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
            PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
            USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
            KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
            USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
            GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
            COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
            ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
            SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
            ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
            OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData
            Language of compilation systemCountry where language is spokenMap
            EnglishGreat Britain
            EnglishUnited States
            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Oct 22, 2024 16:12:57.729471922 CEST1.1.1.1192.168.2.80x1697No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.netazurefd-t-fb-prod.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
            Oct 22, 2024 16:12:57.729471922 CEST1.1.1.1192.168.2.80x1697No error (0)dual.s-part-0017.t-0009.fb-t-msedge.nets-part-0017.t-0009.fb-t-msedge.netCNAME (Canonical name)IN (0x0001)false
            Oct 22, 2024 16:12:57.729471922 CEST1.1.1.1192.168.2.80x1697No error (0)s-part-0017.t-0009.fb-t-msedge.net13.107.253.45A (IP address)IN (0x0001)false

            Click to jump to process

            Click to jump to process

            Click to dive into process behavior distribution

            Click to jump to process

            Target ID:0
            Start time:10:11:53
            Start date:22/10/2024
            Path:C:\Users\user\Desktop\Payment confirmaton copy.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\Payment confirmaton copy.exe"
            Imagebase:0x400000
            File size:1'332'351 bytes
            MD5 hash:7A025CB6D0132C24480C220A138A5BA0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            Target ID:2
            Start time:10:11:57
            Start date:22/10/2024
            Path:C:\Windows\SysWOW64\svchost.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\Payment confirmaton copy.exe"
            Imagebase:0x190000
            File size:46'504 bytes
            MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1822308967.0000000003550000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1822009491.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
            Reputation:high
            Has exited:true

            Reset < >

              Execution Graph

              Execution Coverage:3.2%
              Dynamic/Decrypted Code Coverage:1.9%
              Signature Coverage:4.1%
              Total number of Nodes:1696
              Total number of Limit Nodes:52
              execution_graph 84425 467046 84426 46705d 84425->84426 84436 467136 84425->84436 84427 4671a0 84426->84427 84428 46710d 84426->84428 84429 467199 84426->84429 84438 46706e 84426->84438 84431 41171a 75 API calls 84427->84431 84432 41171a 75 API calls 84428->84432 84459 40e380 VariantClear moneypunct 84429->84459 84444 4670f3 _realloc 84431->84444 84432->84444 84433 4670d2 84435 41171a 75 API calls 84433->84435 84434 41171a 75 API calls 84434->84436 84437 4670d8 84435->84437 84457 443466 75 API calls 84437->84457 84443 4670a9 moneypunct 84438->84443 84445 41171a 84438->84445 84441 4670e8 84458 45efe7 77 API calls moneypunct 84441->84458 84443->84427 84443->84433 84443->84444 84444->84434 84447 411724 84445->84447 84448 41173e 84447->84448 84451 411740 std::bad_alloc::bad_alloc 84447->84451 84460 4138ba 84447->84460 84478 411afc 6 API calls __decode_pointer 84447->84478 84448->84443 84455 411766 84451->84455 84479 411421 84451->84479 84452 411770 84483 41805b RaiseException 84452->84483 84482 4116fd 67 API calls std::exception::exception 84455->84482 84456 41177e 84457->84441 84458->84444 84459->84427 84461 41396d 84460->84461 84465 4138cc 84460->84465 84491 411afc 6 API calls __decode_pointer 84461->84491 84463 4138dd 84463->84465 84484 418252 67 API calls 2 library calls 84463->84484 84485 4180a7 67 API calls 7 library calls 84463->84485 84486 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84463->84486 84464 413973 84492 417f23 67 API calls __getptd_noexit 84464->84492 84465->84463 84470 413929 RtlAllocateHeap 84465->84470 84472 413965 84465->84472 84473 413959 84465->84473 84476 41395e 84465->84476 84487 41386b 67 API calls 4 library calls 84465->84487 84488 411afc 6 API calls __decode_pointer 84465->84488 84470->84465 84472->84447 84489 417f23 67 API calls __getptd_noexit 84473->84489 84490 417f23 67 API calls __getptd_noexit 84476->84490 84478->84447 84493 4113e5 84479->84493 84481 41142e 84481->84455 84482->84452 84483->84456 84484->84463 84485->84463 84487->84465 84488->84465 84489->84476 84490->84472 84491->84464 84492->84472 84494 4113f1 type_info::_Type_info_dtor 84493->84494 84501 41181b 84494->84501 84500 411412 type_info::_Type_info_dtor 84500->84481 84527 418407 84501->84527 84503 4113f6 84504 4112fa 84503->84504 84592 4169e9 TlsGetValue 84504->84592 84507 4169e9 __decode_pointer 6 API calls 84508 41131e 84507->84508 84509 4113a1 84508->84509 84602 4170e7 68 API calls 5 library calls 84508->84602 84524 41141b 84509->84524 84511 41133c 84512 411388 84511->84512 84515 411357 84511->84515 84516 411366 84511->84516 84513 41696e __encode_pointer 6 API calls 84512->84513 84514 411396 84513->84514 84519 41696e __encode_pointer 6 API calls 84514->84519 84603 417047 73 API calls _realloc 84515->84603 84516->84509 84518 411360 84516->84518 84518->84516 84521 41137c 84518->84521 84604 417047 73 API calls _realloc 84518->84604 84519->84509 84605 41696e TlsGetValue 84521->84605 84522 411376 84522->84509 84522->84521 84617 411824 84524->84617 84528 41841c 84527->84528 84529 41842f EnterCriticalSection 84527->84529 84534 418344 84528->84534 84529->84503 84531 418422 84531->84529 84562 4117af 67 API calls 3 library calls 84531->84562 84533 41842e 84533->84529 84535 418350 type_info::_Type_info_dtor 84534->84535 84536 418360 84535->84536 84537 418378 84535->84537 84563 418252 67 API calls 2 library calls 84536->84563 84545 418386 type_info::_Type_info_dtor 84537->84545 84566 416fb6 84537->84566 84540 418365 84564 4180a7 67 API calls 7 library calls 84540->84564 84543 4183a7 84548 418407 __lock 67 API calls 84543->84548 84544 418398 84572 417f23 67 API calls __getptd_noexit 84544->84572 84545->84531 84546 41836c 84565 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84546->84565 84550 4183ae 84548->84550 84552 4183e2 84550->84552 84553 4183b6 84550->84553 84554 413a88 type_info::_Type_info_dtor 67 API calls 84552->84554 84573 4189e6 InitializeCriticalSectionAndSpinCount type_info::_Type_info_dtor 84553->84573 84556 4183d3 84554->84556 84588 4183fe LeaveCriticalSection _doexit 84556->84588 84557 4183c1 84557->84556 84574 413a88 84557->84574 84560 4183cd 84587 417f23 67 API calls __getptd_noexit 84560->84587 84562->84533 84563->84540 84564->84546 84569 416fbf 84566->84569 84567 4138ba _malloc 66 API calls 84567->84569 84568 416ff5 84568->84543 84568->84544 84569->84567 84569->84568 84570 416fd6 Sleep 84569->84570 84571 416feb 84570->84571 84571->84568 84571->84569 84572->84545 84573->84557 84576 413a94 type_info::_Type_info_dtor 84574->84576 84575 413b0d type_info::_Type_info_dtor _realloc 84575->84560 84576->84575 84578 418407 __lock 65 API calls 84576->84578 84586 413ad3 84576->84586 84577 413ae8 RtlFreeHeap 84577->84575 84579 413afa 84577->84579 84583 413aab ___sbh_find_block 84578->84583 84591 417f23 67 API calls __getptd_noexit 84579->84591 84581 413aff GetLastError 84581->84575 84582 413ac5 84590 413ade LeaveCriticalSection _doexit 84582->84590 84583->84582 84589 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __cftoe2_l 84583->84589 84586->84575 84586->84577 84587->84556 84588->84545 84589->84582 84590->84586 84591->84581 84593 416a01 84592->84593 84594 416a22 GetModuleHandleW 84592->84594 84593->84594 84597 416a0b TlsGetValue 84593->84597 84595 416a32 84594->84595 84596 416a3d GetProcAddress 84594->84596 84615 41177f Sleep GetModuleHandleW 84595->84615 84601 41130e 84596->84601 84599 416a16 84597->84599 84599->84594 84599->84601 84600 416a38 84600->84596 84600->84601 84601->84507 84602->84511 84603->84518 84604->84522 84606 4169a7 GetModuleHandleW 84605->84606 84607 416986 84605->84607 84608 4169c2 GetProcAddress 84606->84608 84609 4169b7 84606->84609 84607->84606 84610 416990 TlsGetValue 84607->84610 84614 41699f 84608->84614 84616 41177f Sleep GetModuleHandleW 84609->84616 84612 41699b 84610->84612 84612->84606 84612->84614 84613 4169bd 84613->84608 84613->84614 84614->84512 84615->84600 84616->84613 84620 41832d LeaveCriticalSection 84617->84620 84619 411420 84619->84500 84620->84619 84621 4444e4 84626 40d900 84621->84626 84623 4444ee 84630 43723d 84623->84630 84625 444504 84627 40d917 84626->84627 84628 40d909 84626->84628 84627->84628 84629 40d91c CloseHandle 84627->84629 84628->84623 84629->84623 84631 40d900 CloseHandle 84630->84631 84632 437247 moneypunct 84631->84632 84632->84625 84633 400c9c3 84636 400c638 84633->84636 84635 400ca0f 84649 400a068 84636->84649 84638 400c6d7 84641 400c731 VirtualAlloc 84638->84641 84642 400c715 84638->84642 84647 400c838 CloseHandle 84638->84647 84648 400c848 VirtualFree 84638->84648 84652 400d548 GetPEB 84638->84652 84640 400c708 CreateFileW 84640->84638 84640->84642 84641->84642 84643 400c752 ReadFile 84641->84643 84644 400c932 84642->84644 84645 400c924 VirtualFree 84642->84645 84643->84642 84646 400c770 VirtualAlloc 84643->84646 84644->84635 84645->84644 84646->84638 84646->84642 84647->84638 84648->84638 84651 400a6f3 84649->84651 84654 400d4e8 GetPEB 84649->84654 84651->84638 84653 400d572 84652->84653 84653->84640 84654->84651 84655 444343 84658 444326 84655->84658 84657 44434e WriteFile 84659 444340 84658->84659 84660 4442c7 84658->84660 84659->84657 84665 40e190 SetFilePointerEx 84660->84665 84662 4442e0 SetFilePointerEx 84666 40e190 SetFilePointerEx 84662->84666 84664 4442ff 84664->84657 84665->84662 84666->84664 84667 46d22f 84670 46d098 84667->84670 84669 46d241 84671 46d0b5 84670->84671 84672 46d115 84671->84672 84673 46d0b9 84671->84673 84725 45c216 78 API calls 84672->84725 84674 41171a 75 API calls 84673->84674 84676 46d0c0 84674->84676 84678 46d0cc 84676->84678 84714 40d940 76 API calls 84676->84714 84677 46d126 84679 46d0f8 84677->84679 84685 46d142 84677->84685 84715 453063 84678->84715 84721 4092c0 84679->84721 84682 46d0fd 84682->84669 84686 46d1c8 84685->84686 84688 46d158 84685->84688 84735 4676a3 78 API calls 84686->84735 84691 453063 111 API calls 84688->84691 84689 46d0ea 84689->84685 84692 46d0ee 84689->84692 84705 46d15e 84691->84705 84692->84679 84720 44ade5 CloseHandle moneypunct 84692->84720 84693 46d1ce 84736 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84693->84736 84694 46d18d 84726 467fce 82 API calls 84694->84726 84696 46d196 84727 4013a0 84696->84727 84700 46d1e7 84703 4092c0 VariantClear 84700->84703 84712 46d194 84700->84712 84703->84712 84704 46d1ac 84733 40d3b0 75 API calls 2 library calls 84704->84733 84705->84694 84705->84696 84707 46d224 84707->84669 84708 46d1b8 84734 467fce 82 API calls 84708->84734 84709 40d900 CloseHandle 84711 46d216 84709->84711 84737 44ade5 CloseHandle moneypunct 84711->84737 84712->84707 84712->84709 84714->84678 84716 45306e 84715->84716 84717 45307a 84715->84717 84716->84717 84738 452e2a 111 API calls 5 library calls 84716->84738 84719 40dfa0 83 API calls 84717->84719 84719->84689 84720->84679 84722 4092c8 moneypunct 84721->84722 84723 429db0 VariantClear 84722->84723 84724 4092d5 moneypunct 84722->84724 84723->84724 84724->84682 84725->84677 84726->84712 84728 41171a 75 API calls 84727->84728 84729 4013c4 84728->84729 84739 401380 84729->84739 84732 40df50 75 API calls 84732->84704 84733->84708 84734->84712 84735->84693 84736->84700 84737->84707 84738->84717 84740 41171a 75 API calls 84739->84740 84741 401387 84740->84741 84741->84732 84742 40116e 84743 401119 DefWindowProcW 84742->84743 84744 429212 84749 410b90 84744->84749 84747 411421 __cinit 74 API calls 84748 42922f 84747->84748 84750 410b9a __write_nolock 84749->84750 84751 41171a 75 API calls 84750->84751 84752 410c31 GetModuleFileNameW 84751->84752 84766 413db0 84752->84766 84754 410c66 _wcsncat 84769 413e3c 84754->84769 84757 41171a 75 API calls 84758 410ca3 _wcscpy 84757->84758 84759 410cd1 RegOpenKeyExW 84758->84759 84760 429bc3 RegQueryValueExW 84759->84760 84761 410cf7 84759->84761 84762 429cd9 RegCloseKey 84760->84762 84763 429bf2 _wcscat _wcslen _wcsncpy 84760->84763 84761->84747 84764 41171a 75 API calls 84763->84764 84765 429cd8 84763->84765 84764->84763 84765->84762 84772 413b95 84766->84772 84802 41abec 84769->84802 84773 413c2f 84772->84773 84779 413bae 84772->84779 84774 413d60 84773->84774 84775 413d7b 84773->84775 84798 417f23 67 API calls __getptd_noexit 84774->84798 84800 417f23 67 API calls __getptd_noexit 84775->84800 84778 413d65 84783 413cfb 84778->84783 84799 417ebb 6 API calls 2 library calls 84778->84799 84779->84773 84788 413c1d 84779->84788 84794 41ab19 67 API calls __cftoe2_l 84779->84794 84782 413d03 84782->84773 84782->84783 84785 413d8e 84782->84785 84783->84754 84784 413cb9 84784->84773 84786 413cd6 84784->84786 84796 41ab19 67 API calls __cftoe2_l 84784->84796 84801 41ab19 67 API calls __cftoe2_l 84785->84801 84786->84773 84786->84783 84790 413cef 84786->84790 84788->84773 84793 413c9b 84788->84793 84795 41ab19 67 API calls __cftoe2_l 84788->84795 84797 41ab19 67 API calls __cftoe2_l 84790->84797 84793->84782 84793->84784 84794->84788 84795->84793 84796->84786 84797->84783 84798->84778 84800->84778 84801->84783 84803 41ac02 84802->84803 84804 41abfd 84802->84804 84811 417f23 67 API calls __getptd_noexit 84803->84811 84804->84803 84806 41ac22 84804->84806 84810 410c99 84806->84810 84813 417f23 67 API calls __getptd_noexit 84806->84813 84809 41ac07 84812 417ebb 6 API calls 2 library calls 84809->84812 84810->84757 84811->84809 84813->84809 84814 401230 84815 401241 _memset 84814->84815 84816 4012c5 84814->84816 84829 401be0 84815->84829 84818 40126b 84819 4012ae KillTimer SetTimer 84818->84819 84820 42aa61 84818->84820 84821 401298 84818->84821 84819->84816 84824 42aa8b Shell_NotifyIconW 84820->84824 84825 42aa69 Shell_NotifyIconW 84820->84825 84822 4012a2 84821->84822 84823 42aaac 84821->84823 84822->84819 84826 42aaf8 Shell_NotifyIconW 84822->84826 84827 42aad7 Shell_NotifyIconW 84823->84827 84828 42aab5 Shell_NotifyIconW 84823->84828 84824->84819 84825->84819 84826->84819 84827->84819 84828->84819 84830 401bfb 84829->84830 84850 401cde 84829->84850 84831 4013a0 75 API calls 84830->84831 84832 401c0b 84831->84832 84833 42a9a0 LoadStringW 84832->84833 84834 401c18 84832->84834 84836 42a9bb 84833->84836 84851 4021e0 84834->84851 84864 40df50 75 API calls 84836->84864 84837 401c2d 84839 401c3a 84837->84839 84840 42a9cd 84837->84840 84839->84836 84841 401c44 84839->84841 84865 40d3b0 75 API calls 2 library calls 84840->84865 84863 40d3b0 75 API calls 2 library calls 84841->84863 84844 42a9dc 84845 42a9f0 84844->84845 84847 401c53 _memset _wcscpy _wcsncpy 84844->84847 84866 40d3b0 75 API calls 2 library calls 84845->84866 84849 401cc2 Shell_NotifyIconW 84847->84849 84848 42a9fe 84849->84850 84850->84818 84852 4021f1 _wcslen 84851->84852 84853 42a598 84851->84853 84856 402205 84852->84856 84857 402226 84852->84857 84868 40c740 84853->84868 84855 42a5a2 84867 404020 75 API calls moneypunct 84856->84867 84858 401380 75 API calls 84857->84858 84861 40222d 84858->84861 84860 40220c _realloc 84860->84837 84861->84855 84862 41171a 75 API calls 84861->84862 84862->84860 84863->84847 84864->84847 84865->84844 84866->84848 84867->84860 84869 40c752 84868->84869 84870 40c747 84868->84870 84869->84855 84870->84869 84873 402ae0 84870->84873 84872 42a572 _realloc 84872->84855 84874 42a06a 84873->84874 84875 402aef 84873->84875 84876 401380 75 API calls 84874->84876 84875->84872 84877 42a072 84876->84877 84878 41171a 75 API calls 84877->84878 84879 42a095 _realloc 84878->84879 84879->84872 84880 4034b0 84881 4034b9 84880->84881 84882 4034bd 84880->84882 84883 41171a 75 API calls 84882->84883 84884 42a0ba 84882->84884 84885 4034fe moneypunct _realloc 84883->84885 84886 40f110 RegOpenKeyExW 84887 40f13c RegQueryValueExW RegCloseKey 84886->84887 84888 40f15f 84886->84888 84887->84888 84889 416193 84926 41718c 84889->84926 84891 41619f GetStartupInfoW 84894 4161c2 84891->84894 84927 41aa31 HeapCreate 84894->84927 84895 416212 84929 416e29 GetModuleHandleW 84895->84929 84900 416223 __RTC_Initialize 84963 41b669 84900->84963 84902 416231 84903 41623d GetCommandLineW 84902->84903 85031 4117af 67 API calls 3 library calls 84902->85031 84978 42235f GetEnvironmentStringsW 84903->84978 84906 41623c 84906->84903 84907 41624c 84984 4222b1 GetModuleFileNameW 84907->84984 84909 416256 84910 416261 84909->84910 85032 4117af 67 API calls 3 library calls 84909->85032 84988 422082 84910->84988 84914 416272 85001 41186e 84914->85001 84917 416279 84919 416284 __wwincmdln 84917->84919 85034 4117af 67 API calls 3 library calls 84917->85034 85007 40d7f0 84919->85007 84922 4162b3 85036 411a4b 67 API calls _doexit 84922->85036 84925 4162b8 type_info::_Type_info_dtor 84926->84891 84928 416206 84927->84928 84928->84895 85029 41616a 67 API calls 3 library calls 84928->85029 84930 416e44 84929->84930 84931 416e3d 84929->84931 84933 416fac 84930->84933 84934 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 84930->84934 85037 41177f Sleep GetModuleHandleW 84931->85037 85047 416ad5 70 API calls 2 library calls 84933->85047 84937 416e97 TlsAlloc 84934->84937 84936 416e43 84936->84930 84939 416218 84937->84939 84940 416ee5 TlsSetValue 84937->84940 84939->84900 85030 41616a 67 API calls 3 library calls 84939->85030 84940->84939 84941 416ef6 84940->84941 85038 411a69 6 API calls 4 library calls 84941->85038 84943 416efb 84944 41696e __encode_pointer 6 API calls 84943->84944 84945 416f06 84944->84945 84946 41696e __encode_pointer 6 API calls 84945->84946 84947 416f16 84946->84947 84948 41696e __encode_pointer 6 API calls 84947->84948 84949 416f26 84948->84949 84950 41696e __encode_pointer 6 API calls 84949->84950 84951 416f36 84950->84951 85039 41828b InitializeCriticalSectionAndSpinCount ___lock_fhandle 84951->85039 84953 416f43 84953->84933 84954 4169e9 __decode_pointer 6 API calls 84953->84954 84955 416f57 84954->84955 84955->84933 85040 416ffb 84955->85040 84958 4169e9 __decode_pointer 6 API calls 84959 416f8a 84958->84959 84959->84933 84960 416f91 84959->84960 85046 416b12 67 API calls 5 library calls 84960->85046 84962 416f99 GetCurrentThreadId 84962->84939 85066 41718c 84963->85066 84965 41b675 GetStartupInfoA 84966 416ffb __calloc_crt 67 API calls 84965->84966 84972 41b696 84966->84972 84967 41b8b4 type_info::_Type_info_dtor 84967->84902 84968 41b831 GetStdHandle 84977 41b7fb 84968->84977 84969 41b896 SetHandleCount 84969->84967 84970 416ffb __calloc_crt 67 API calls 84970->84972 84971 41b843 GetFileType 84971->84977 84972->84967 84972->84970 84973 41b77e 84972->84973 84972->84977 84973->84967 84974 41b7a7 GetFileType 84973->84974 84973->84977 85067 4189e6 InitializeCriticalSectionAndSpinCount type_info::_Type_info_dtor 84973->85067 84974->84973 84977->84967 84977->84968 84977->84969 84977->84971 85068 4189e6 InitializeCriticalSectionAndSpinCount type_info::_Type_info_dtor 84977->85068 84979 422370 84978->84979 84980 422374 84978->84980 84979->84907 84981 416fb6 __malloc_crt 67 API calls 84980->84981 84982 422395 _realloc 84981->84982 84983 42239c FreeEnvironmentStringsW 84982->84983 84983->84907 84985 4222e6 _wparse_cmdline 84984->84985 84986 416fb6 __malloc_crt 67 API calls 84985->84986 84987 422329 _wparse_cmdline 84985->84987 84986->84987 84987->84909 84989 42209a _wcslen 84988->84989 84993 416267 84988->84993 84990 416ffb __calloc_crt 67 API calls 84989->84990 84996 4220be _wcslen 84990->84996 84991 422123 84992 413a88 type_info::_Type_info_dtor 67 API calls 84991->84992 84992->84993 84993->84914 85033 4117af 67 API calls 3 library calls 84993->85033 84994 416ffb __calloc_crt 67 API calls 84994->84996 84995 422149 84997 413a88 type_info::_Type_info_dtor 67 API calls 84995->84997 84996->84991 84996->84993 84996->84994 84996->84995 84999 422108 84996->84999 85069 426349 67 API calls __cftoe2_l 84996->85069 84997->84993 84999->84996 85070 417d93 10 API calls 3 library calls 84999->85070 85002 41187c __IsNonwritableInCurrentImage 85001->85002 85071 418486 85002->85071 85004 41189a __initterm_e 85005 411421 __cinit 74 API calls 85004->85005 85006 4118b9 __IsNonwritableInCurrentImage __initterm 85004->85006 85005->85006 85006->84917 85008 431bcb 85007->85008 85009 40d80c 85007->85009 85010 4092c0 VariantClear 85009->85010 85011 40d847 85010->85011 85075 40eb50 85011->85075 85014 40d877 85078 411ac6 67 API calls 4 library calls 85014->85078 85017 40d888 85079 411b24 67 API calls __cftoe2_l 85017->85079 85019 40d891 85080 40f370 SystemParametersInfoW SystemParametersInfoW 85019->85080 85021 40d89f 85081 40d6d0 GetCurrentDirectoryW 85021->85081 85023 40d8a7 SystemParametersInfoW 85024 40d8cd 85023->85024 85025 4092c0 VariantClear 85024->85025 85026 40d8dd 85025->85026 85027 4092c0 VariantClear 85026->85027 85028 40d8e6 85027->85028 85028->84922 85035 411a1f 67 API calls _doexit 85028->85035 85029->84895 85030->84900 85031->84906 85032->84910 85033->84914 85034->84919 85035->84922 85036->84925 85037->84936 85038->84943 85039->84953 85043 417004 85040->85043 85042 416f70 85042->84933 85042->84958 85043->85042 85044 417022 Sleep 85043->85044 85048 422452 85043->85048 85045 417037 85044->85045 85045->85042 85045->85043 85046->84962 85047->84939 85049 42245e type_info::_Type_info_dtor 85048->85049 85050 422476 85049->85050 85060 422495 _memset 85049->85060 85061 417f23 67 API calls __getptd_noexit 85050->85061 85052 42247b 85062 417ebb 6 API calls 2 library calls 85052->85062 85053 422507 HeapAlloc 85053->85060 85055 42248b type_info::_Type_info_dtor 85055->85043 85057 418407 __lock 66 API calls 85057->85060 85060->85053 85060->85055 85060->85057 85063 41a74c 5 API calls 2 library calls 85060->85063 85064 42254e LeaveCriticalSection _doexit 85060->85064 85065 411afc 6 API calls __decode_pointer 85060->85065 85061->85052 85063->85060 85064->85060 85065->85060 85066->84965 85067->84973 85068->84977 85069->84996 85070->84999 85072 41848c 85071->85072 85073 41696e __encode_pointer 6 API calls 85072->85073 85074 4184a4 85072->85074 85073->85072 85074->85004 85119 40eb70 85075->85119 85078->85017 85079->85019 85080->85021 85123 401f80 85081->85123 85083 40d6f1 IsDebuggerPresent 85084 431a9d MessageBoxA 85083->85084 85085 40d6ff 85083->85085 85086 431ab6 85084->85086 85085->85086 85087 40d71f 85085->85087 85225 403e90 75 API calls 3 library calls 85086->85225 85193 40f3b0 85087->85193 85091 40d73a GetFullPathNameW 85223 401440 127 API calls _wcscat 85091->85223 85093 40d77a 85094 40d782 85093->85094 85095 431b09 SetCurrentDirectoryW 85093->85095 85096 40d78b 85094->85096 85226 43604b 6 API calls 85094->85226 85095->85094 85205 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85096->85205 85099 431b28 85099->85096 85101 431b30 GetModuleFileNameW 85099->85101 85103 431ba4 GetForegroundWindow ShellExecuteW 85101->85103 85104 431b4c 85101->85104 85106 40d7c7 85103->85106 85227 401b70 85104->85227 85105 40d795 85112 40d7a8 85105->85112 85213 40e1e0 85105->85213 85110 40d7d1 SetCurrentDirectoryW 85106->85110 85110->85023 85112->85106 85224 401000 Shell_NotifyIconW _memset 85112->85224 85113 431b66 85234 40d3b0 75 API calls 2 library calls 85113->85234 85116 431b72 GetForegroundWindow ShellExecuteW 85117 431b9f 85116->85117 85117->85106 85118 40eba0 LoadLibraryA GetProcAddress 85118->85014 85120 40d86e 85119->85120 85121 40eb76 LoadLibraryA 85119->85121 85120->85014 85120->85118 85121->85120 85122 40eb87 GetProcAddress 85121->85122 85122->85120 85235 40e680 85123->85235 85127 401fa2 GetModuleFileNameW 85253 40ff90 85127->85253 85129 401fbd 85265 4107b0 85129->85265 85132 401b70 75 API calls 85133 401fe4 85132->85133 85268 4019e0 85133->85268 85135 401ff2 85136 4092c0 VariantClear 85135->85136 85137 402002 85136->85137 85138 401b70 75 API calls 85137->85138 85139 40201c 85138->85139 85140 4019e0 76 API calls 85139->85140 85141 40202c 85140->85141 85142 401b70 75 API calls 85141->85142 85143 40203c 85142->85143 85276 40c3e0 85143->85276 85145 40204d 85294 40c060 85145->85294 85149 40206e 85306 4115d0 85149->85306 85152 42c174 85154 401a70 75 API calls 85152->85154 85153 402088 85155 4115d0 __wcsicoll 79 API calls 85153->85155 85156 42c189 85154->85156 85157 402093 85155->85157 85159 401a70 75 API calls 85156->85159 85157->85156 85158 40209e 85157->85158 85160 4115d0 __wcsicoll 79 API calls 85158->85160 85161 42c1a7 85159->85161 85162 4020a9 85160->85162 85163 42c1b0 GetModuleFileNameW 85161->85163 85162->85163 85164 4020b4 85162->85164 85166 401a70 75 API calls 85163->85166 85165 4115d0 __wcsicoll 79 API calls 85164->85165 85167 4020bf 85165->85167 85168 42c1e2 85166->85168 85171 42c20a _wcscpy 85167->85171 85174 401a70 75 API calls 85167->85174 85184 402107 85167->85184 85318 40df50 75 API calls 85168->85318 85170 42c1f1 85175 401a70 75 API calls 85170->85175 85179 401a70 75 API calls 85171->85179 85172 42c243 85173 402119 85173->85172 85314 40e7e0 76 API calls 85173->85314 85177 4020e5 _wcscpy 85174->85177 85178 42c201 85175->85178 85182 401a70 75 API calls 85177->85182 85178->85171 85188 402148 85179->85188 85180 402132 85315 40d030 76 API calls 85180->85315 85182->85184 85183 40213e 85185 4092c0 VariantClear 85183->85185 85184->85171 85184->85173 85185->85188 85186 402184 85190 4092c0 VariantClear 85186->85190 85188->85186 85191 401a70 75 API calls 85188->85191 85316 40d030 76 API calls 85188->85316 85317 40e640 76 API calls 85188->85317 85192 402196 moneypunct 85190->85192 85191->85188 85192->85083 85194 42ccf4 _memset 85193->85194 85195 40f3c9 85193->85195 85198 42cd05 GetOpenFileNameW 85194->85198 85995 40ffb0 76 API calls moneypunct 85195->85995 85197 40f3d2 85996 410130 SHGetMalloc 85197->85996 85198->85195 85200 40d732 85198->85200 85200->85091 85200->85093 85201 40f3d9 86001 410020 88 API calls __wcsicoll 85201->86001 85203 40f3e7 86002 40f400 85203->86002 85206 42b9d3 85205->85206 85207 41025a LoadImageW RegisterClassExW 85205->85207 86049 443e8f EnumResourceNamesW LoadImageW 85206->86049 86048 4102f0 7 API calls 85207->86048 85210 40d790 85212 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85210->85212 85211 42b9da 85212->85105 85215 40e207 _memset 85213->85215 85214 40e262 85218 40e2a4 85214->85218 86050 43737d 84 API calls __wcsicoll 85214->86050 85215->85214 85216 42aa14 DestroyIcon 85215->85216 85216->85214 85219 40e2c0 Shell_NotifyIconW 85218->85219 85220 42aa50 Shell_NotifyIconW 85218->85220 85221 401be0 77 API calls 85219->85221 85222 40e2da 85221->85222 85222->85112 85223->85093 85224->85106 85225->85093 85226->85099 85228 401b76 _wcslen 85227->85228 85229 41171a 75 API calls 85228->85229 85232 401bc5 85228->85232 85230 401bad _realloc 85229->85230 85231 41171a 75 API calls 85230->85231 85231->85232 85233 40d3b0 75 API calls 2 library calls 85232->85233 85233->85113 85234->85116 85236 40c060 75 API calls 85235->85236 85237 401f90 85236->85237 85238 402940 85237->85238 85239 40294a __write_nolock 85238->85239 85240 4021e0 75 API calls 85239->85240 85242 402972 85240->85242 85252 4029a4 85242->85252 85319 401cf0 85242->85319 85243 402ae0 75 API calls 85243->85252 85244 402a8c 85245 401b70 75 API calls 85244->85245 85251 402abe 85244->85251 85246 402ab3 85245->85246 85323 40d970 75 API calls 2 library calls 85246->85323 85247 401b70 75 API calls 85247->85252 85249 401cf0 75 API calls 85249->85252 85251->85127 85252->85243 85252->85244 85252->85247 85252->85249 85322 40d970 75 API calls 2 library calls 85252->85322 85324 40f5e0 85253->85324 85255 40ffa6 85255->85129 85258 42b6d8 85259 42b6e6 85258->85259 85380 434fe1 85258->85380 85261 413a88 type_info::_Type_info_dtor 67 API calls 85259->85261 85262 42b6f5 85261->85262 85263 434fe1 106 API calls 85262->85263 85264 42b702 85263->85264 85264->85129 85266 41171a 75 API calls 85265->85266 85267 401fd6 85266->85267 85267->85132 85269 401a03 85268->85269 85273 4019e5 85268->85273 85270 401a1a 85269->85270 85269->85273 85984 404260 76 API calls 85270->85984 85272 4019ff 85272->85135 85273->85272 85983 404260 76 API calls 85273->85983 85275 401a26 85275->85135 85277 40c3e4 85276->85277 85278 40c42c 85276->85278 85279 40c3f0 85277->85279 85280 42a475 85277->85280 85281 42a422 85278->85281 85282 40c435 85278->85282 85985 4042f0 75 API calls __cinit 85279->85985 85990 453155 75 API calls 85280->85990 85284 42a427 85281->85284 85285 42a445 85281->85285 85286 40c441 85282->85286 85287 42a455 85282->85287 85292 40c3fb 85284->85292 85987 453155 75 API calls 85284->85987 85988 453155 75 API calls 85285->85988 85986 4042f0 75 API calls __cinit 85286->85986 85989 453155 75 API calls 85287->85989 85292->85145 85295 41171a 75 API calls 85294->85295 85296 40c088 85295->85296 85297 41171a 75 API calls 85296->85297 85298 402061 85297->85298 85299 401a70 85298->85299 85300 401a90 85299->85300 85301 401a77 85299->85301 85303 4021e0 75 API calls 85300->85303 85302 401a8d 85301->85302 85991 404080 75 API calls _realloc 85301->85991 85302->85149 85305 401a9c 85303->85305 85305->85149 85307 4115e1 85306->85307 85308 411650 85306->85308 85313 40207d 85307->85313 85992 417f23 67 API calls __getptd_noexit 85307->85992 85994 4114bf 79 API calls 3 library calls 85308->85994 85311 4115ed 85993 417ebb 6 API calls 2 library calls 85311->85993 85313->85152 85313->85153 85314->85180 85315->85183 85316->85188 85317->85188 85318->85170 85320 402ae0 75 API calls 85319->85320 85321 401cf7 85320->85321 85321->85242 85322->85252 85323->85251 85384 40f580 85324->85384 85326 40f5f8 _strcat moneypunct 85392 40f6d0 85326->85392 85331 42b2ee 85421 4151b0 85331->85421 85333 40f679 85333->85331 85334 40f681 85333->85334 85408 414e94 85334->85408 85338 40f68b 85338->85255 85343 452574 85338->85343 85340 42b31d 85427 415484 85340->85427 85342 42b33d 85344 41557c _fseek 105 API calls 85343->85344 85345 4525df 85344->85345 85928 4523ce 85345->85928 85348 4525fc 85348->85258 85349 4151b0 __fread_nolock 81 API calls 85350 45261d 85349->85350 85351 4151b0 __fread_nolock 81 API calls 85350->85351 85352 45262e 85351->85352 85353 4151b0 __fread_nolock 81 API calls 85352->85353 85354 452649 85353->85354 85355 4151b0 __fread_nolock 81 API calls 85354->85355 85356 452666 85355->85356 85357 41557c _fseek 105 API calls 85356->85357 85358 452682 85357->85358 85359 4138ba _malloc 67 API calls 85358->85359 85360 45268e 85359->85360 85361 4138ba _malloc 67 API calls 85360->85361 85362 45269b 85361->85362 85363 4151b0 __fread_nolock 81 API calls 85362->85363 85364 4526ac 85363->85364 85365 44afdc GetSystemTimeAsFileTime 85364->85365 85366 4526bf 85365->85366 85367 4526d5 85366->85367 85368 4526fd 85366->85368 85371 413a88 type_info::_Type_info_dtor 67 API calls 85367->85371 85369 452704 85368->85369 85370 45275b 85368->85370 85934 44b195 85369->85934 85373 413a88 type_info::_Type_info_dtor 67 API calls 85370->85373 85374 4526df 85371->85374 85376 452759 85373->85376 85377 413a88 type_info::_Type_info_dtor 67 API calls 85374->85377 85375 452753 85379 413a88 type_info::_Type_info_dtor 67 API calls 85375->85379 85376->85258 85378 4526e8 85377->85378 85378->85258 85379->85376 85381 434ff1 85380->85381 85382 434feb 85380->85382 85381->85259 85383 414e94 __fcloseall 106 API calls 85382->85383 85383->85381 85385 429440 85384->85385 85386 40f589 _wcslen 85384->85386 85387 40f58f WideCharToMultiByte 85386->85387 85388 40f5d8 85387->85388 85389 40f5ad 85387->85389 85388->85326 85390 41171a 75 API calls 85389->85390 85391 40f5bb WideCharToMultiByte 85390->85391 85391->85326 85393 40f6dd _strlen 85392->85393 85440 40f790 85393->85440 85396 414e06 85459 414d40 85396->85459 85398 40f666 85398->85331 85399 40f450 85398->85399 85404 40f45a _strcat _realloc __write_nolock 85399->85404 85400 4151b0 __fread_nolock 81 API calls 85400->85404 85401 40f531 85401->85333 85403 42936d 85405 41557c _fseek 105 API calls 85403->85405 85404->85400 85404->85401 85404->85403 85542 41557c 85404->85542 85406 429394 85405->85406 85407 4151b0 __fread_nolock 81 API calls 85406->85407 85407->85401 85409 414ea0 type_info::_Type_info_dtor 85408->85409 85410 414ed1 85409->85410 85411 414eb4 85409->85411 85413 415965 __lock_file 68 API calls 85410->85413 85418 414ec9 type_info::_Type_info_dtor 85410->85418 85681 417f23 67 API calls __getptd_noexit 85411->85681 85415 414ee9 85413->85415 85414 414eb9 85682 417ebb 6 API calls 2 library calls 85414->85682 85665 414e1d 85415->85665 85418->85338 85750 41511a 85421->85750 85423 4151c8 85424 44afdc 85423->85424 85921 4431e0 85424->85921 85426 44affd 85426->85340 85428 415490 type_info::_Type_info_dtor 85427->85428 85429 4154bb 85428->85429 85430 41549e 85428->85430 85431 415965 __lock_file 68 API calls 85429->85431 85925 417f23 67 API calls __getptd_noexit 85430->85925 85433 4154c3 85431->85433 85435 4152e7 __ftell_nolock 71 API calls 85433->85435 85434 4154a3 85926 417ebb 6 API calls 2 library calls 85434->85926 85437 4154cf 85435->85437 85927 4154e8 LeaveCriticalSection LeaveCriticalSection _fseek 85437->85927 85439 4154b3 type_info::_Type_info_dtor 85439->85342 85441 40f7ae _memset 85440->85441 85443 40f628 85441->85443 85444 415258 85441->85444 85443->85396 85445 415285 85444->85445 85446 415268 85444->85446 85445->85446 85448 41528c 85445->85448 85455 417f23 67 API calls __getptd_noexit 85446->85455 85457 41c551 103 API calls 14 library calls 85448->85457 85450 41526d 85456 417ebb 6 API calls 2 library calls 85450->85456 85451 4152b2 85453 41527d 85451->85453 85458 4191c9 101 API calls 6 library calls 85451->85458 85453->85441 85455->85450 85457->85451 85458->85453 85460 414d4c type_info::_Type_info_dtor 85459->85460 85461 414d5f 85460->85461 85464 414d95 85460->85464 85511 417f23 67 API calls __getptd_noexit 85461->85511 85463 414d64 85512 417ebb 6 API calls 2 library calls 85463->85512 85478 41e28c 85464->85478 85467 414d9a 85468 414da1 85467->85468 85469 414dae 85467->85469 85513 417f23 67 API calls __getptd_noexit 85468->85513 85471 414dd6 85469->85471 85472 414db6 85469->85472 85496 41dfd8 85471->85496 85514 417f23 67 API calls __getptd_noexit 85472->85514 85477 414d74 type_info::_Type_info_dtor @_EH4_CallFilterFunc@8 85477->85398 85479 41e298 type_info::_Type_info_dtor 85478->85479 85480 418407 __lock 67 API calls 85479->85480 85486 41e2a6 85480->85486 85481 41e322 85483 416fb6 __malloc_crt 67 API calls 85481->85483 85485 41e32c 85483->85485 85484 41e3b0 type_info::_Type_info_dtor 85484->85467 85493 41e31b 85485->85493 85521 4189e6 InitializeCriticalSectionAndSpinCount type_info::_Type_info_dtor 85485->85521 85486->85481 85487 418344 __mtinitlocknum 67 API calls 85486->85487 85486->85493 85519 4159a6 68 API calls __lock 85486->85519 85520 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85486->85520 85487->85486 85490 41e351 85491 41e35c 85490->85491 85492 41e36f EnterCriticalSection 85490->85492 85494 413a88 type_info::_Type_info_dtor 67 API calls 85491->85494 85492->85493 85516 41e3bb 85493->85516 85494->85493 85505 41dffb __wopenfile 85496->85505 85497 41e015 85526 417f23 67 API calls __getptd_noexit 85497->85526 85499 41e1e9 85499->85497 85502 41e247 85499->85502 85500 41e01a 85527 417ebb 6 API calls 2 library calls 85500->85527 85523 425db0 85502->85523 85505->85497 85505->85499 85528 4136bc 79 API calls 2 library calls 85505->85528 85507 41e1e2 85507->85499 85529 4136bc 79 API calls 2 library calls 85507->85529 85509 41e201 85509->85499 85530 4136bc 79 API calls 2 library calls 85509->85530 85511->85463 85513->85477 85514->85477 85515 414dfc LeaveCriticalSection LeaveCriticalSection _fseek 85515->85477 85522 41832d LeaveCriticalSection 85516->85522 85518 41e3c2 85518->85484 85519->85486 85520->85486 85521->85490 85522->85518 85531 425ce4 85523->85531 85525 414de1 85525->85515 85526->85500 85528->85507 85529->85509 85530->85499 85532 425cf0 type_info::_Type_info_dtor 85531->85532 85533 425d03 85532->85533 85536 425d41 85532->85536 85534 417f23 __cftoe2_l 67 API calls 85533->85534 85535 425d08 85534->85535 85537 417ebb __cftoe2_l 6 API calls 85535->85537 85538 4255c4 __tsopen_nolock 132 API calls 85536->85538 85541 425d17 type_info::_Type_info_dtor 85537->85541 85539 425d5b 85538->85539 85540 425d82 __sopen_helper LeaveCriticalSection 85539->85540 85540->85541 85541->85525 85543 415588 type_info::_Type_info_dtor 85542->85543 85544 415596 85543->85544 85546 4155c4 85543->85546 85573 417f23 67 API calls __getptd_noexit 85544->85573 85555 415965 85546->85555 85548 41559b 85574 417ebb 6 API calls 2 library calls 85548->85574 85554 4155ab type_info::_Type_info_dtor 85554->85404 85556 415977 85555->85556 85557 415999 EnterCriticalSection 85555->85557 85556->85557 85558 41597f 85556->85558 85559 4155cc 85557->85559 85560 418407 __lock 67 API calls 85558->85560 85561 4154f2 85559->85561 85560->85559 85562 415512 85561->85562 85563 415502 85561->85563 85565 415524 85562->85565 85576 4152e7 85562->85576 85630 417f23 67 API calls __getptd_noexit 85563->85630 85593 41486c 85565->85593 85566 415507 85575 4155f7 LeaveCriticalSection LeaveCriticalSection _fseek 85566->85575 85573->85548 85575->85554 85577 41531a 85576->85577 85578 4152fa 85576->85578 85580 41453a __fileno 67 API calls 85577->85580 85631 417f23 67 API calls __getptd_noexit 85578->85631 85581 415320 85580->85581 85584 41efd4 __locking 71 API calls 85581->85584 85582 4152ff 85632 417ebb 6 API calls 2 library calls 85582->85632 85585 415335 85584->85585 85586 4153a9 85585->85586 85588 415364 85585->85588 85592 41530f 85585->85592 85633 417f23 67 API calls __getptd_noexit 85586->85633 85589 41efd4 __locking 71 API calls 85588->85589 85588->85592 85590 415404 85589->85590 85591 41efd4 __locking 71 API calls 85590->85591 85590->85592 85591->85592 85592->85565 85594 414885 85593->85594 85595 4148a7 85593->85595 85594->85595 85596 41453a __fileno 67 API calls 85594->85596 85599 41453a 85595->85599 85597 4148a0 85596->85597 85634 41c3cf 101 API calls 6 library calls 85597->85634 85600 41455e 85599->85600 85601 414549 85599->85601 85605 41efd4 85600->85605 85635 417f23 67 API calls __getptd_noexit 85601->85635 85603 41454e 85636 417ebb 6 API calls 2 library calls 85603->85636 85606 41efe0 type_info::_Type_info_dtor 85605->85606 85607 41f003 85606->85607 85608 41efe8 85606->85608 85609 41f011 85607->85609 85614 41f052 85607->85614 85657 417f36 67 API calls __getptd_noexit 85608->85657 85659 417f36 67 API calls __getptd_noexit 85609->85659 85612 41efed 85658 417f23 67 API calls __getptd_noexit 85612->85658 85613 41f016 85660 417f23 67 API calls __getptd_noexit 85613->85660 85637 41ba3b 85614->85637 85618 41f01d 85661 417ebb 6 API calls 2 library calls 85618->85661 85619 41f058 85622 41f065 85619->85622 85623 41f07b 85619->85623 85620 41eff5 type_info::_Type_info_dtor 85620->85566 85647 41ef5f 85622->85647 85662 417f23 67 API calls __getptd_noexit 85623->85662 85626 41f080 85663 417f36 67 API calls __getptd_noexit 85626->85663 85627 41f073 85664 41f0a6 LeaveCriticalSection __unlock_fhandle 85627->85664 85630->85566 85631->85582 85633->85592 85634->85595 85635->85603 85639 41ba47 type_info::_Type_info_dtor 85637->85639 85638 41baa2 85641 41bac4 type_info::_Type_info_dtor 85638->85641 85642 41baa7 EnterCriticalSection 85638->85642 85639->85638 85640 418407 __lock 67 API calls 85639->85640 85643 41ba73 85640->85643 85641->85619 85642->85641 85644 41ba8a 85643->85644 85645 4189e6 ___lock_fhandle InitializeCriticalSectionAndSpinCount 85643->85645 85646 41bad2 ___lock_fhandle LeaveCriticalSection 85644->85646 85645->85644 85646->85638 85648 41b9c4 __lseek_nolock 67 API calls 85647->85648 85649 41ef6e 85648->85649 85650 41ef84 SetFilePointer 85649->85650 85651 41ef74 85649->85651 85653 41ef9b GetLastError 85650->85653 85655 41efa3 85650->85655 85652 417f23 __cftoe2_l 67 API calls 85651->85652 85654 41ef79 85652->85654 85653->85655 85654->85627 85655->85654 85656 417f49 __dosmaperr 67 API calls 85655->85656 85656->85654 85657->85612 85658->85620 85659->85613 85660->85618 85662->85626 85663->85627 85664->85620 85666 414e31 85665->85666 85667 414e4d 85665->85667 85711 417f23 67 API calls __getptd_noexit 85666->85711 85669 414e46 85667->85669 85671 41486c __flush 101 API calls 85667->85671 85683 414f08 LeaveCriticalSection LeaveCriticalSection _fseek 85669->85683 85670 414e36 85712 417ebb 6 API calls 2 library calls 85670->85712 85673 414e59 85671->85673 85684 41e680 85673->85684 85676 41453a __fileno 67 API calls 85677 414e67 85676->85677 85688 41e5b3 85677->85688 85679 414e6d 85679->85669 85680 413a88 type_info::_Type_info_dtor 67 API calls 85679->85680 85680->85669 85681->85414 85683->85418 85685 41e690 85684->85685 85686 414e61 85684->85686 85685->85686 85687 413a88 type_info::_Type_info_dtor 67 API calls 85685->85687 85686->85676 85687->85686 85689 41e5bf type_info::_Type_info_dtor 85688->85689 85690 41e5c7 85689->85690 85693 41e5e2 85689->85693 85728 417f36 67 API calls __getptd_noexit 85690->85728 85692 41e5f0 85730 417f36 67 API calls __getptd_noexit 85692->85730 85693->85692 85696 41e631 85693->85696 85694 41e5cc 85729 417f23 67 API calls __getptd_noexit 85694->85729 85699 41ba3b ___lock_fhandle 68 API calls 85696->85699 85698 41e5f5 85731 417f23 67 API calls __getptd_noexit 85698->85731 85701 41e637 85699->85701 85704 41e652 85701->85704 85705 41e644 85701->85705 85702 41e5fc 85732 417ebb 6 API calls 2 library calls 85702->85732 85733 417f23 67 API calls __getptd_noexit 85704->85733 85713 41e517 85705->85713 85706 41e5d4 type_info::_Type_info_dtor 85706->85679 85709 41e64c 85734 41e676 LeaveCriticalSection __unlock_fhandle 85709->85734 85711->85670 85735 41b9c4 85713->85735 85715 41e57d 85748 41b93e 68 API calls 2 library calls 85715->85748 85717 41e527 85717->85715 85718 41e55b 85717->85718 85720 41b9c4 __lseek_nolock 67 API calls 85717->85720 85718->85715 85721 41b9c4 __lseek_nolock 67 API calls 85718->85721 85719 41e585 85722 41e5a7 85719->85722 85749 417f49 67 API calls 3 library calls 85719->85749 85723 41e552 85720->85723 85724 41e567 CloseHandle 85721->85724 85722->85709 85726 41b9c4 __lseek_nolock 67 API calls 85723->85726 85724->85715 85727 41e573 GetLastError 85724->85727 85726->85718 85727->85715 85728->85694 85729->85706 85730->85698 85731->85702 85733->85709 85734->85706 85736 41b9d1 85735->85736 85737 41b9e9 85735->85737 85738 417f36 __read_nolock 67 API calls 85736->85738 85739 417f36 __read_nolock 67 API calls 85737->85739 85741 41ba2e 85737->85741 85740 41b9d6 85738->85740 85742 41ba17 85739->85742 85743 417f23 __cftoe2_l 67 API calls 85740->85743 85741->85717 85745 417f23 __cftoe2_l 67 API calls 85742->85745 85744 41b9de 85743->85744 85744->85717 85746 41ba1e 85745->85746 85747 417ebb __cftoe2_l 6 API calls 85746->85747 85747->85741 85748->85719 85749->85722 85751 415126 type_info::_Type_info_dtor 85750->85751 85752 41513a _memset 85751->85752 85753 41516f 85751->85753 85755 415164 type_info::_Type_info_dtor 85751->85755 85779 417f23 67 API calls __getptd_noexit 85752->85779 85754 415965 __lock_file 68 API calls 85753->85754 85756 415177 85754->85756 85755->85423 85763 414f10 85756->85763 85759 415154 85780 417ebb 6 API calls 2 library calls 85759->85780 85764 414f4c 85763->85764 85767 414f2e _memset 85763->85767 85781 4151a6 LeaveCriticalSection LeaveCriticalSection _fseek 85764->85781 85765 414f37 85832 417f23 67 API calls __getptd_noexit 85765->85832 85767->85764 85767->85765 85768 414f8b 85767->85768 85768->85764 85771 4150d5 _memset 85768->85771 85772 4150a9 _memset 85768->85772 85773 41453a __fileno 67 API calls 85768->85773 85782 41ed9e 85768->85782 85812 41e6b1 85768->85812 85834 41ee9b 67 API calls 3 library calls 85768->85834 85836 417f23 67 API calls __getptd_noexit 85771->85836 85835 417f23 67 API calls __getptd_noexit 85772->85835 85773->85768 85777 414f3c 85833 417ebb 6 API calls 2 library calls 85777->85833 85779->85759 85781->85755 85783 41edaa type_info::_Type_info_dtor 85782->85783 85784 41edb2 85783->85784 85785 41edcd 85783->85785 85906 417f36 67 API calls __getptd_noexit 85784->85906 85786 41eddb 85785->85786 85791 41ee1c 85785->85791 85908 417f36 67 API calls __getptd_noexit 85786->85908 85789 41edb7 85907 417f23 67 API calls __getptd_noexit 85789->85907 85790 41ede0 85909 417f23 67 API calls __getptd_noexit 85790->85909 85794 41ee29 85791->85794 85795 41ee3d 85791->85795 85911 417f36 67 API calls __getptd_noexit 85794->85911 85796 41ba3b ___lock_fhandle 68 API calls 85795->85796 85799 41ee43 85796->85799 85798 41ee2e 85912 417f23 67 API calls __getptd_noexit 85798->85912 85801 41ee50 85799->85801 85802 41ee66 85799->85802 85837 41e7dc 85801->85837 85913 417f23 67 API calls __getptd_noexit 85802->85913 85804 41ede7 85910 417ebb 6 API calls 2 library calls 85804->85910 85807 41ee5e 85915 41ee91 LeaveCriticalSection __unlock_fhandle 85807->85915 85808 41ee6b 85914 417f36 67 API calls __getptd_noexit 85808->85914 85811 41edbf type_info::_Type_info_dtor 85811->85768 85813 41e6c1 85812->85813 85817 41e6de 85812->85817 85919 417f23 67 API calls __getptd_noexit 85813->85919 85815 41e6c6 85920 417ebb 6 API calls 2 library calls 85815->85920 85818 41e713 85817->85818 85824 41e6d6 85817->85824 85916 423600 85817->85916 85820 41453a __fileno 67 API calls 85818->85820 85821 41e727 85820->85821 85822 41ed9e __read 79 API calls 85821->85822 85823 41e72e 85822->85823 85823->85824 85825 41453a __fileno 67 API calls 85823->85825 85824->85768 85826 41e751 85825->85826 85826->85824 85827 41453a __fileno 67 API calls 85826->85827 85828 41e75d 85827->85828 85828->85824 85829 41453a __fileno 67 API calls 85828->85829 85830 41e769 85829->85830 85831 41453a __fileno 67 API calls 85830->85831 85831->85824 85832->85777 85834->85768 85835->85777 85836->85777 85838 41e813 85837->85838 85839 41e7f8 85837->85839 85841 41e822 85838->85841 85843 41e849 85838->85843 85840 417f36 __read_nolock 67 API calls 85839->85840 85842 41e7fd 85840->85842 85844 417f36 __read_nolock 67 API calls 85841->85844 85845 417f23 __cftoe2_l 67 API calls 85842->85845 85847 41e868 85843->85847 85859 41e87c 85843->85859 85846 41e827 85844->85846 85860 41e805 85845->85860 85849 417f23 __cftoe2_l 67 API calls 85846->85849 85850 417f36 __read_nolock 67 API calls 85847->85850 85848 41e8d4 85853 417f36 __read_nolock 67 API calls 85848->85853 85852 41e82e 85849->85852 85851 41e86d 85850->85851 85854 417f23 __cftoe2_l 67 API calls 85851->85854 85855 417ebb __cftoe2_l 6 API calls 85852->85855 85856 41e8d9 85853->85856 85858 41e874 85854->85858 85855->85860 85857 417f23 __cftoe2_l 67 API calls 85856->85857 85857->85858 85862 417ebb __cftoe2_l 6 API calls 85858->85862 85859->85848 85859->85860 85861 41e8b0 85859->85861 85864 41e8f5 85859->85864 85860->85807 85861->85848 85863 41e8bb ReadFile 85861->85863 85862->85860 85868 41ed62 GetLastError 85863->85868 85869 41e9e7 85863->85869 85866 416fb6 __malloc_crt 67 API calls 85864->85866 85867 41e90b 85866->85867 85872 41e931 85867->85872 85873 41e913 85867->85873 85870 41ebe8 85868->85870 85871 41ed6f 85868->85871 85869->85868 85874 41e9fb 85869->85874 85881 417f49 __dosmaperr 67 API calls 85870->85881 85903 41eb6d 85870->85903 85876 417f23 __cftoe2_l 67 API calls 85871->85876 85875 423462 __lseeki64_nolock 69 API calls 85872->85875 85877 417f23 __cftoe2_l 67 API calls 85873->85877 85887 41ec2d 85874->85887 85893 41ea17 85874->85893 85874->85903 85878 41e93d 85875->85878 85879 41ed74 85876->85879 85880 41e918 85877->85880 85878->85863 85882 417f36 __read_nolock 67 API calls 85879->85882 85883 417f36 __read_nolock 67 API calls 85880->85883 85881->85903 85882->85903 85883->85860 85884 413a88 type_info::_Type_info_dtor 67 API calls 85884->85860 85885 41ea7d ReadFile 85888 41ea9b GetLastError 85885->85888 85896 41eaa5 85885->85896 85886 41eca5 ReadFile 85889 41ecc4 GetLastError 85886->85889 85897 41ecce 85886->85897 85887->85886 85887->85903 85888->85893 85888->85896 85889->85887 85889->85897 85890 41ebbe MultiByteToWideChar 85891 41ebe2 GetLastError 85890->85891 85890->85903 85891->85870 85892 41eafa 85894 41eb75 85892->85894 85895 41eb68 85892->85895 85899 41eb32 85892->85899 85892->85903 85893->85885 85893->85892 85894->85899 85900 41ebac 85894->85900 85898 417f23 __cftoe2_l 67 API calls 85895->85898 85896->85893 85901 423462 __lseeki64_nolock 69 API calls 85896->85901 85897->85887 85902 423462 __lseeki64_nolock 69 API calls 85897->85902 85898->85903 85899->85890 85904 423462 __lseeki64_nolock 69 API calls 85900->85904 85901->85896 85902->85897 85903->85860 85903->85884 85905 41ebbb 85904->85905 85905->85890 85906->85789 85907->85811 85908->85790 85909->85804 85911->85798 85912->85804 85913->85808 85914->85807 85915->85811 85917 416fb6 __malloc_crt 67 API calls 85916->85917 85918 423615 85917->85918 85918->85818 85919->85815 85924 414cef GetSystemTimeAsFileTime __aulldiv 85921->85924 85923 4431ef 85923->85426 85924->85923 85925->85434 85927->85439 85932 4523e1 _wcscpy 85928->85932 85929 4151b0 81 API calls __fread_nolock 85929->85932 85930 44afdc GetSystemTimeAsFileTime 85930->85932 85931 452553 85931->85348 85931->85349 85932->85929 85932->85930 85932->85931 85933 41557c 105 API calls _fseek 85932->85933 85933->85932 85935 44b1b4 85934->85935 85936 44b1a6 85934->85936 85938 44b1ca 85935->85938 85939 44b1c2 85935->85939 85940 414e06 138 API calls 85935->85940 85937 414e06 138 API calls 85936->85937 85937->85935 85969 4352d1 81 API calls 2 library calls 85938->85969 85939->85375 85941 44b2c1 85940->85941 85941->85938 85943 44b2cf 85941->85943 85945 44b2dc 85943->85945 85948 414e94 __fcloseall 106 API calls 85943->85948 85944 44b20d 85946 44b211 85944->85946 85947 44b23b 85944->85947 85945->85375 85950 44b21e 85946->85950 85952 414e94 __fcloseall 106 API calls 85946->85952 85970 43526e 85947->85970 85948->85945 85953 44b22e 85950->85953 85954 414e94 __fcloseall 106 API calls 85950->85954 85951 44b242 85955 44b270 85951->85955 85956 44b248 85951->85956 85952->85950 85953->85375 85954->85953 85980 44b0af 111 API calls 85955->85980 85958 44b255 85956->85958 85960 414e94 __fcloseall 106 API calls 85956->85960 85961 44b265 85958->85961 85963 414e94 __fcloseall 106 API calls 85958->85963 85959 44b276 85981 43522c 67 API calls type_info::_Type_info_dtor 85959->85981 85960->85958 85961->85375 85963->85961 85964 44b27c 85965 44b289 85964->85965 85966 414e94 __fcloseall 106 API calls 85964->85966 85967 44b299 85965->85967 85968 414e94 __fcloseall 106 API calls 85965->85968 85966->85965 85967->85375 85968->85967 85969->85944 85971 4138ba _malloc 67 API calls 85970->85971 85972 43527d 85971->85972 85973 4138ba _malloc 67 API calls 85972->85973 85974 43528d 85973->85974 85975 4138ba _malloc 67 API calls 85974->85975 85976 43529d 85975->85976 85978 4352bc 85976->85978 85982 43522c 67 API calls type_info::_Type_info_dtor 85976->85982 85978->85951 85979 4352c8 85979->85951 85980->85959 85981->85964 85982->85979 85983->85272 85984->85275 85985->85292 85986->85292 85987->85292 85988->85287 85989->85292 85990->85292 85991->85302 85992->85311 85994->85313 85995->85197 85997 410148 SHGetDesktopFolder 85996->85997 86000 4101a3 _wcscpy 85996->86000 85998 41015a _wcscpy 85997->85998 85997->86000 85999 41018a SHGetPathFromIDListW 85998->85999 85998->86000 85999->86000 86000->85201 86001->85203 86003 40f5e0 152 API calls 86002->86003 86004 40f417 86003->86004 86005 42ca37 86004->86005 86006 40f42c 86004->86006 86007 42ca1f 86004->86007 86008 452574 140 API calls 86005->86008 86043 4037e0 139 API calls 7 library calls 86006->86043 86044 43717f 110 API calls _printf 86007->86044 86011 42ca50 86008->86011 86012 42ca76 86011->86012 86013 42ca54 86011->86013 86017 41171a 75 API calls 86012->86017 86016 434fe1 106 API calls 86013->86016 86014 40f446 86014->85200 86015 42ca2d 86015->86005 86018 42ca5e 86016->86018 86032 42cacc moneypunct 86017->86032 86045 43717f 110 API calls _printf 86018->86045 86020 42ca6c 86020->86012 86021 42ccc3 86022 413a88 type_info::_Type_info_dtor 67 API calls 86021->86022 86023 42cccd 86022->86023 86024 434fe1 106 API calls 86023->86024 86025 42ccda 86024->86025 86029 401b70 75 API calls 86029->86032 86032->86021 86032->86029 86033 445051 86032->86033 86036 402cc0 75 API calls 2 library calls 86032->86036 86037 4026a0 86032->86037 86046 44c80c 87 API calls 3 library calls 86032->86046 86047 44b408 75 API calls 86032->86047 86034 41171a 75 API calls 86033->86034 86035 445080 _realloc 86034->86035 86035->86032 86035->86035 86036->86032 86038 4026af 86037->86038 86041 40276b 86037->86041 86039 41171a 75 API calls 86038->86039 86038->86041 86042 4026ee moneypunct 86038->86042 86039->86042 86040 41171a 75 API calls 86040->86042 86041->86032 86042->86040 86042->86041 86043->86014 86044->86015 86045->86020 86046->86032 86047->86032 86048->85210 86049->85211 86050->85218 86051 431914 86052 431920 86051->86052 86053 431928 86052->86053 86054 43193d 86052->86054 86315 45e62e 116 API calls 3 library calls 86053->86315 86316 47f2b4 174 API calls 86054->86316 86057 43194a 86064 4095b0 moneypunct 86057->86064 86317 45e62e 116 API calls 3 library calls 86057->86317 86058 409708 86061 4097af 86061->86058 86302 40d590 VariantClear 86061->86302 86063 4315b8 WaitForSingleObject 86063->86064 86066 4315d6 GetExitCodeProcess CloseHandle 86063->86066 86064->86058 86064->86061 86064->86063 86067 431623 Sleep 86064->86067 86071 40986e Sleep 86064->86071 86074 4098f1 TranslateMessage DispatchMessageW 86064->86074 86085 409894 86064->86085 86088 45e62e 116 API calls 86064->86088 86093 4319c9 VariantClear 86064->86093 86095 4092c0 VariantClear 86064->86095 86097 40b380 86064->86097 86121 409340 86064->86121 86154 409030 86064->86154 86168 40d300 86064->86168 86173 40d320 86064->86173 86179 409a40 86064->86179 86318 40e380 VariantClear moneypunct 86064->86318 86306 40d590 VariantClear 86066->86306 86070 43163b timeGetTime 86067->86070 86067->86085 86070->86085 86075 409880 timeGetTime 86071->86075 86071->86085 86074->86064 86075->86085 86076 431673 CloseHandle 86076->86085 86077 43170c GetExitCodeProcess CloseHandle 86077->86085 86078 40d590 VariantClear 86078->86085 86080 46dd22 133 API calls 86080->86085 86081 46e641 134 API calls 86081->86085 86084 431781 Sleep 86084->86064 86085->86064 86085->86076 86085->86077 86085->86078 86085->86080 86085->86081 86085->86084 86094 4092c0 VariantClear 86085->86094 86303 447e59 75 API calls 86085->86303 86304 453b07 77 API calls 86085->86304 86305 4646a2 76 API calls 86085->86305 86307 444233 88 API calls _wcslen 86085->86307 86308 457509 VariantClear 86085->86308 86309 404120 86085->86309 86313 4717e3 VariantClear 86085->86313 86314 436272 6 API calls 86085->86314 86088->86064 86093->86064 86094->86085 86095->86064 86098 40b3a5 86097->86098 86099 40b53d 86097->86099 86100 430a99 86098->86100 86106 40b3b6 86098->86106 86319 45e62e 116 API calls 3 library calls 86099->86319 86320 45e62e 116 API calls 3 library calls 86100->86320 86103 430aae 86108 4092c0 VariantClear 86103->86108 86104 40b528 86104->86064 86106->86103 86109 40b3f2 86106->86109 86120 40b4fd moneypunct 86106->86120 86107 430dc9 86107->86107 86108->86104 86110 40b429 86109->86110 86111 430ae9 VariantClear 86109->86111 86113 40b476 moneypunct 86109->86113 86119 40b43b moneypunct 86110->86119 86321 40e380 VariantClear moneypunct 86110->86321 86111->86119 86112 40b4eb 86112->86120 86322 40e380 VariantClear moneypunct 86112->86322 86113->86112 86116 430d08 moneypunct 86113->86116 86114 430d41 VariantClear 86114->86120 86116->86114 86116->86120 86117 41171a 75 API calls 86117->86113 86119->86113 86119->86117 86120->86104 86323 45e62e 116 API calls 3 library calls 86120->86323 86122 409386 86121->86122 86126 409395 86121->86126 86324 4042f0 75 API calls __cinit 86122->86324 86125 42fba9 86328 45e62e 116 API calls 3 library calls 86125->86328 86126->86125 86128 42fc07 86126->86128 86130 42fc85 86126->86130 86133 42fd4f 86126->86133 86134 42fcd8 86126->86134 86138 42fd39 86126->86138 86142 40946f 86126->86142 86143 40947b 86126->86143 86145 4094c1 86126->86145 86150 4092c0 VariantClear 86126->86150 86151 409484 moneypunct 86126->86151 86327 453155 75 API calls 86126->86327 86329 40c620 118 API calls 86126->86329 86331 45e62e 116 API calls 3 library calls 86126->86331 86330 45e62e 116 API calls 3 library calls 86128->86330 86332 4781ae 140 API calls 86130->86332 86135 4092c0 VariantClear 86133->86135 86334 47f2b4 174 API calls 86134->86334 86135->86151 86137 42fc9c 86137->86151 86333 45e62e 116 API calls 3 library calls 86137->86333 86336 45e62e 116 API calls 3 library calls 86138->86336 86139 42fce9 86139->86151 86335 45e62e 116 API calls 3 library calls 86139->86335 86325 409210 VariantClear 86142->86325 86148 4092c0 VariantClear 86143->86148 86145->86151 86326 404260 76 API calls 86145->86326 86148->86151 86150->86126 86151->86064 86152 4094e1 86153 4092c0 VariantClear 86152->86153 86153->86151 86337 409110 117 API calls 86154->86337 86156 42ceb6 86347 410ae0 VariantClear moneypunct 86156->86347 86158 40906e 86158->86156 86160 42cea9 86158->86160 86162 4090a4 86158->86162 86159 42cebf 86346 45e62e 116 API calls 3 library calls 86160->86346 86338 404160 86162->86338 86165 4090f0 moneypunct 86165->86064 86166 4092c0 VariantClear 86167 4090be moneypunct 86166->86167 86167->86165 86167->86166 86169 4292e3 86168->86169 86170 40d30c 86168->86170 86171 429323 86169->86171 86172 4292fd TranslateAcceleratorW 86169->86172 86170->86064 86171->86064 86172->86170 86174 4296d0 86173->86174 86177 40d32f 86173->86177 86174->86064 86175 40d33c 86175->86064 86176 42972a IsDialogMessageW 86176->86175 86176->86177 86177->86175 86177->86176 86478 4340ec GetClassLongW 86177->86478 86180 409a66 _wcslen 86179->86180 86181 41171a 75 API calls 86180->86181 86240 40aade moneypunct _realloc 86180->86240 86182 409a9c _realloc 86181->86182 86184 41171a 75 API calls 86182->86184 86183 401380 75 API calls 86185 42cee9 86183->86185 86186 409abd 86184->86186 86187 41171a 75 API calls 86185->86187 86188 409aeb CharUpperBuffW 86186->86188 86190 409b09 moneypunct 86186->86190 86186->86240 86196 42cf10 _realloc 86187->86196 86188->86190 86228 409b88 moneypunct 86190->86228 86480 47d10e 150 API calls 86190->86480 86192 4092c0 VariantClear 86193 42e5e0 86192->86193 86510 410ae0 VariantClear moneypunct 86193->86510 86195 42e5f2 86509 45e62e 116 API calls 3 library calls 86196->86509 86197 409e4a 86197->86196 86200 41171a 75 API calls 86197->86200 86204 409ea4 86197->86204 86198 40aa5b 86201 41171a 75 API calls 86198->86201 86199 41171a 75 API calls 86199->86228 86200->86204 86217 40aa81 moneypunct _realloc 86201->86217 86202 40c3e0 75 API calls 86202->86228 86203 409ed0 86207 42d50d 86203->86207 86261 409ef8 moneypunct _realloc 86203->86261 86489 40b800 VariantClear VariantClear moneypunct 86203->86489 86204->86203 86205 41171a 75 API calls 86204->86205 86206 42d480 86205->86206 86208 42d491 86206->86208 86485 44b3f6 75 API calls 86206->86485 86210 42d527 86207->86210 86490 40b800 VariantClear VariantClear moneypunct 86207->86490 86486 40df50 75 API calls 86208->86486 86210->86261 86491 40e2e0 VariantClear moneypunct 86210->86491 86211 40a3a7 86214 40a415 86211->86214 86263 42db5c 86211->86263 86212 42d195 VariantClear 86212->86228 86221 41171a 75 API calls 86214->86221 86215 4092c0 VariantClear 86215->86228 86223 41171a 75 API calls 86217->86223 86237 40a41c 86221->86237 86223->86240 86224 42d4a6 86487 4530b3 75 API calls 86224->86487 86226 42db96 86496 45e62e 116 API calls 3 library calls 86226->86496 86228->86196 86228->86197 86228->86198 86228->86199 86228->86202 86228->86212 86228->86215 86228->86217 86230 42d128 86228->86230 86233 42d20c 86228->86233 86242 42dbb9 86228->86242 86481 40c620 118 API calls 86228->86481 86483 40be00 75 API calls 2 library calls 86228->86483 86484 40e380 VariantClear moneypunct 86228->86484 86232 4092c0 VariantClear 86230->86232 86231 42d4d7 86488 4530b3 75 API calls 86231->86488 86236 42d131 86232->86236 86233->86064 86482 410ae0 VariantClear moneypunct 86236->86482 86246 40a481 86237->86246 86497 40c8a0 VariantClear moneypunct 86237->86497 86240->86183 86242->86192 86243 44b3f6 75 API calls 86243->86261 86245 4092c0 VariantClear 86274 40a534 moneypunct _realloc 86245->86274 86247 40a4ed 86246->86247 86249 42dc1e VariantClear 86246->86249 86246->86274 86254 40a4ff moneypunct 86247->86254 86498 40e380 VariantClear moneypunct 86247->86498 86248 402cc0 75 API calls 86248->86261 86249->86254 86252 4019e0 76 API calls 86252->86261 86253 41171a 75 API calls 86253->86274 86254->86253 86254->86274 86257 42deb6 VariantClear 86257->86274 86258 411421 74 API calls __cinit 86258->86261 86259 41171a 75 API calls 86259->86261 86260 40a73c 86262 42e237 86260->86262 86270 40a76b 86260->86270 86261->86211 86261->86226 86261->86240 86261->86243 86261->86248 86261->86252 86261->86258 86261->86259 86261->86263 86269 40a053 86261->86269 86492 45ee98 75 API calls 86261->86492 86493 404260 76 API calls 86261->86493 86494 409210 VariantClear 86261->86494 86502 46e709 VariantClear VariantClear moneypunct 86262->86502 86495 4721e5 VariantClear 86263->86495 86264 42dfe9 VariantClear 86264->86274 86265 42df47 VariantClear 86265->86274 86266 40a7a2 86279 40a7ad moneypunct 86266->86279 86503 40b800 VariantClear VariantClear moneypunct 86266->86503 86268 40e380 VariantClear 86268->86274 86269->86064 86270->86266 86295 40a800 moneypunct 86270->86295 86479 40b800 VariantClear VariantClear moneypunct 86270->86479 86273 41171a 75 API calls 86278 42dd10 VariantInit VariantCopy 86273->86278 86274->86245 86274->86257 86274->86260 86274->86262 86274->86264 86274->86265 86274->86268 86274->86273 86283 41171a 75 API calls 86274->86283 86499 46e9cd 75 API calls 86274->86499 86500 409210 VariantClear 86274->86500 86501 44cc6c VariantClear moneypunct 86274->86501 86275 40a8b0 86286 40a8c2 moneypunct 86275->86286 86505 40e380 VariantClear moneypunct 86275->86505 86276 42e312 86277 42e337 VariantClear 86276->86277 86276->86286 86277->86286 86278->86274 86281 42dd30 VariantClear 86278->86281 86280 40a7ee 86279->86280 86288 42e2a7 VariantClear 86279->86288 86279->86295 86280->86295 86504 40e380 VariantClear moneypunct 86280->86504 86281->86274 86282 42e3b2 86289 42e3da VariantClear 86282->86289 86293 40a91a moneypunct 86282->86293 86283->86274 86286->86282 86287 40a908 86286->86287 86287->86293 86506 40e380 VariantClear moneypunct 86287->86506 86288->86295 86289->86293 86290 42e47f 86296 42e4a3 VariantClear 86290->86296 86301 40a957 moneypunct 86290->86301 86293->86290 86294 40a945 86293->86294 86294->86301 86507 40e380 VariantClear moneypunct 86294->86507 86295->86275 86295->86276 86296->86301 86298 40aa22 moneypunct 86298->86064 86299 42e559 VariantClear 86299->86301 86301->86298 86301->86299 86508 40e380 VariantClear moneypunct 86301->86508 86302->86058 86303->86085 86304->86085 86305->86085 86306->86085 86307->86085 86308->86085 86310 40412e 86309->86310 86311 4092c0 VariantClear 86310->86311 86312 404138 86311->86312 86312->86084 86313->86085 86314->86085 86315->86064 86316->86057 86317->86064 86318->86064 86319->86100 86320->86103 86321->86119 86322->86120 86323->86107 86324->86126 86325->86143 86326->86152 86327->86126 86328->86151 86329->86126 86330->86151 86331->86126 86332->86137 86333->86151 86334->86139 86335->86151 86336->86133 86337->86158 86339 4092c0 VariantClear 86338->86339 86340 40416e 86339->86340 86341 404120 VariantClear 86340->86341 86342 40419b 86341->86342 86348 4734b7 86342->86348 86390 40efe0 86342->86390 86343 4041c6 86343->86156 86343->86167 86346->86156 86347->86159 86349 453063 111 API calls 86348->86349 86350 4734d7 86349->86350 86351 473545 86350->86351 86352 47350c 86350->86352 86398 463c42 86351->86398 86353 4092c0 VariantClear 86352->86353 86359 473514 86353->86359 86355 473558 86356 47355c 86355->86356 86373 473595 86355->86373 86358 4092c0 VariantClear 86356->86358 86357 473616 86411 463d7e 86357->86411 86367 473564 86358->86367 86359->86343 86361 473622 86363 473697 86361->86363 86364 47362c 86361->86364 86362 453063 111 API calls 86362->86373 86443 457838 86363->86443 86366 4092c0 VariantClear 86364->86366 86370 473634 86366->86370 86367->86343 86370->86343 86372 473655 86375 4092c0 VariantClear 86372->86375 86373->86357 86373->86362 86373->86372 86455 462f5a 87 API calls __wcsicoll 86373->86455 86385 47365d 86375->86385 86376 4736b0 86456 45e62e 116 API calls 3 library calls 86376->86456 86377 4736c9 86457 40e7e0 76 API calls 86377->86457 86380 4736ba GetCurrentProcess TerminateProcess 86380->86377 86381 4736db 86382 4736ff 86381->86382 86458 40d030 76 API calls 86381->86458 86389 473731 86382->86389 86460 40d030 76 API calls 86382->86460 86461 46b945 134 API calls 2 library calls 86382->86461 86384 4736f1 86459 46b945 134 API calls 2 library calls 86384->86459 86385->86343 86389->86343 86391 40eff5 CreateFileW 86390->86391 86392 4299bf 86390->86392 86393 40f017 86391->86393 86392->86393 86394 4299c4 CreateFileW 86392->86394 86393->86343 86394->86393 86395 4299ea 86394->86395 86477 40e0d0 SetFilePointerEx SetFilePointerEx 86395->86477 86397 4299f5 86397->86393 86462 45335b 76 API calls 86398->86462 86400 463c5d 86463 442c52 80 API calls _wcslen 86400->86463 86402 463c72 86404 40c060 75 API calls 86402->86404 86410 463cac 86402->86410 86405 463c8e 86404->86405 86464 4608ce 75 API calls _realloc 86405->86464 86407 463cf7 86407->86355 86408 463ca4 86409 40c740 75 API calls 86408->86409 86409->86410 86410->86407 86465 462f5a 87 API calls __wcsicoll 86410->86465 86412 453063 111 API calls 86411->86412 86413 463d99 86412->86413 86414 463de0 86413->86414 86415 463dca 86413->86415 86467 40c760 78 API calls 86414->86467 86466 453081 111 API calls 86415->86466 86418 463de7 86433 463e19 86418->86433 86468 40c760 78 API calls 86418->86468 86419 463dd0 LoadLibraryW 86420 463e09 86419->86420 86422 463e3e 86420->86422 86420->86433 86424 463e4e 86422->86424 86425 463e7b 86422->86425 86423 463dfb 86423->86433 86469 40c760 78 API calls 86423->86469 86470 40d500 75 API calls 86424->86470 86472 40c760 78 API calls 86425->86472 86429 463e57 86471 45efe7 77 API calls moneypunct 86429->86471 86430 463e82 GetProcAddress 86434 463e90 86430->86434 86432 463e62 GetProcAddress 86435 463e79 86432->86435 86433->86361 86434->86433 86434->86435 86435->86434 86473 403470 75 API calls _realloc 86435->86473 86437 463eb4 86474 40d500 75 API calls 86437->86474 86439 463ebd 86475 45efe7 77 API calls moneypunct 86439->86475 86441 463ec8 GetProcAddress 86476 401330 moneypunct 86441->86476 86444 457a4c 86443->86444 86450 45785f _strcat moneypunct _wcslen _wcscpy 86443->86450 86451 410d40 86444->86451 86445 443576 78 API calls 86445->86450 86446 40c760 78 API calls 86446->86450 86447 453081 111 API calls 86447->86450 86448 4138ba 67 API calls _malloc 86448->86450 86449 40f580 77 API calls 86449->86450 86450->86444 86450->86445 86450->86446 86450->86447 86450->86448 86450->86449 86453 410d55 86451->86453 86452 410ded VirtualProtect 86454 410dbb 86452->86454 86453->86452 86453->86454 86454->86376 86454->86377 86455->86373 86456->86380 86457->86381 86458->86384 86459->86382 86460->86382 86461->86382 86462->86400 86463->86402 86464->86408 86465->86407 86466->86419 86467->86418 86468->86423 86469->86420 86470->86429 86471->86432 86472->86430 86473->86437 86474->86439 86475->86441 86476->86433 86477->86397 86478->86177 86479->86266 86480->86190 86481->86228 86482->86298 86483->86228 86484->86228 86485->86208 86486->86224 86487->86231 86488->86203 86489->86207 86490->86210 86491->86261 86492->86261 86493->86261 86494->86261 86495->86226 86496->86242 86497->86237 86498->86254 86499->86274 86500->86274 86501->86274 86502->86266 86503->86279 86504->86295 86505->86286 86506->86293 86507->86301 86508->86301 86509->86242 86510->86195 86511 400c418 86512 400a068 GetPEB 86511->86512 86513 400c4ba 86512->86513 86525 400c308 86513->86525 86515 400c4e3 CreateFileW 86517 400c537 86515->86517 86519 400c532 86515->86519 86518 400c54e VirtualAlloc 86517->86518 86517->86519 86518->86519 86520 400c56c ReadFile 86518->86520 86520->86519 86521 400c587 86520->86521 86522 400b308 13 API calls 86521->86522 86523 400c5ba 86522->86523 86524 400c5dd ExitProcess 86523->86524 86524->86519 86526 400c311 Sleep 86525->86526 86527 400c31f 86526->86527 86528 42919b 86533 40ef10 86528->86533 86531 411421 __cinit 74 API calls 86532 4291aa 86531->86532 86534 41171a 75 API calls 86533->86534 86535 40ef17 86534->86535 86536 42ad48 86535->86536 86541 40ef40 74 API calls __cinit 86535->86541 86538 40ef2a 86542 40e470 86538->86542 86541->86538 86543 40c060 75 API calls 86542->86543 86544 40e483 GetVersionExW 86543->86544 86545 4021e0 75 API calls 86544->86545 86546 40e4bb 86545->86546 86568 40e600 86546->86568 86553 42accc 86554 42ad28 GetSystemInfo 86553->86554 86558 42ad38 GetSystemInfo 86554->86558 86555 40e557 GetCurrentProcess 86588 40ee30 LoadLibraryA GetProcAddress 86555->86588 86556 40e56c 86556->86558 86581 40eee0 86556->86581 86561 40e5c9 86585 40eea0 86561->86585 86564 40e5e0 86566 40e5f1 FreeLibrary 86564->86566 86567 40e5f4 86564->86567 86565 40e5dd FreeLibrary 86565->86564 86566->86567 86567->86531 86569 40e60b 86568->86569 86570 40c740 75 API calls 86569->86570 86571 40e4c2 86570->86571 86572 40e620 86571->86572 86573 40e62a 86572->86573 86574 42ac93 86573->86574 86575 40c740 75 API calls 86573->86575 86576 40e4ce 86575->86576 86576->86553 86577 40ee70 86576->86577 86578 40e551 86577->86578 86579 40ee76 LoadLibraryA 86577->86579 86578->86555 86578->86556 86579->86578 86580 40ee87 GetProcAddress 86579->86580 86580->86578 86582 40e5bf 86581->86582 86583 40eee6 LoadLibraryA 86581->86583 86582->86554 86582->86561 86583->86582 86584 40eef7 GetProcAddress 86583->86584 86584->86582 86589 40eec0 LoadLibraryA GetProcAddress 86585->86589 86587 40e5d3 GetNativeSystemInfo 86587->86564 86587->86565 86588->86556 86589->86587 86590 42e89e 86597 40c000 86590->86597 86592 42e8ac 86593 409a40 165 API calls 86592->86593 86594 42e8ca 86593->86594 86608 44b92e VariantClear 86594->86608 86596 42f3ae 86598 40c014 86597->86598 86599 40c007 86597->86599 86601 40c01a 86598->86601 86602 40c02c 86598->86602 86609 409210 VariantClear 86599->86609 86610 409210 VariantClear 86601->86610 86605 41171a 75 API calls 86602->86605 86603 40c00f 86603->86592 86607 40c033 86605->86607 86606 40c023 86606->86592 86607->86592 86608->86596 86609->86603 86610->86606
              APIs
              • _wcslen.LIBCMT ref: 00409A61
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
              • CharUpperBuffW.USER32(?,?), ref: 00409AF5
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID: 0vH$4RH
              • API String ID: 1143807570-2085553193
              • Opcode ID: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
              • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
              • Opcode Fuzzy Hash: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
              • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B

              Control-flow Graph

              APIs
              • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Payment confirmaton copy.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
              • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
              • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Payment confirmaton copy.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
              • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\Payment confirmaton copy.exe,00000004), ref: 0040D7D6
              • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
              • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\Payment confirmaton copy.exe,00000004), ref: 00431B0E
              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\Payment confirmaton copy.exe,00000004), ref: 00431B3F
              • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
              • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
              • String ID: @GH$@GH$C:\Users\user\Desktop\Payment confirmaton copy.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
              • API String ID: 2493088469-1170660111
              • Opcode ID: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
              • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
              • Opcode Fuzzy Hash: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
              • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1254 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1263 40e506-40e509 1254->1263 1264 42accc-42acd1 1254->1264 1267 40e540-40e555 call 40ee70 1263->1267 1268 40e50b-40e51c 1263->1268 1265 42acd3-42acdb 1264->1265 1266 42acdd-42ace0 1264->1266 1270 42ad12-42ad20 1265->1270 1271 42ace2-42aceb 1266->1271 1272 42aced-42acf0 1266->1272 1281 40e557-40e573 GetCurrentProcess call 40ee30 1267->1281 1282 40e579-40e5a8 1267->1282 1273 40e522-40e525 1268->1273 1274 42ac9b-42aca7 1268->1274 1280 42ad28-42ad2d GetSystemInfo 1270->1280 1271->1270 1272->1270 1278 42acf2-42ad06 1272->1278 1273->1267 1279 40e527-40e537 1273->1279 1276 42acb2-42acba 1274->1276 1277 42aca9-42acad 1274->1277 1276->1267 1277->1267 1283 42ad08-42ad0c 1278->1283 1284 42ad0e 1278->1284 1285 42acbf-42acc7 1279->1285 1286 40e53d 1279->1286 1288 42ad38-42ad3d GetSystemInfo 1280->1288 1281->1282 1295 40e575 1281->1295 1282->1288 1289 40e5ae-40e5c3 call 40eee0 1282->1289 1283->1270 1284->1270 1285->1267 1286->1267 1289->1280 1294 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1289->1294 1298 40e5e0-40e5ef 1294->1298 1299 40e5dd-40e5de FreeLibrary 1294->1299 1295->1282 1300 40e5f1-40e5f2 FreeLibrary 1298->1300 1301 40e5f4-40e5ff 1298->1301 1299->1298 1300->1301
              APIs
              • GetVersionExW.KERNEL32 ref: 0040E495
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
              • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
              • FreeLibrary.KERNEL32(?), ref: 0040E5DE
              • FreeLibrary.KERNEL32(?), ref: 0040E5F2
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
              • String ID: pMH$Wu
              • API String ID: 2923339712-3104548426
              • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
              • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
              • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
              • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
              APIs
              • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
              • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: IsThemeActive$uxtheme.dll
              • API String ID: 2574300362-3542929980
              • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
              • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
              • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
              • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

              Control-flow Graph

              APIs
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
              • __wsplitpath.LIBCMT ref: 00410C61
                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
              • _wcsncat.LIBCMT ref: 00410C78
              • __wmakepath.LIBCMT ref: 00410C94
                • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
              • _wcscpy.LIBCMT ref: 00410CCC
              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
              • RegQueryValueExW.ADVAPI32 ref: 00429BE4
              • _wcscat.LIBCMT ref: 00429C43
              • _wcslen.LIBCMT ref: 00429C55
              • _wcslen.LIBCMT ref: 00429C66
              • _wcscat.LIBCMT ref: 00429C80
              • _wcsncpy.LIBCMT ref: 00429CC0
              • RegCloseKey.ADVAPI32(?), ref: 00429CDE
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID: Include$Software\AutoIt v3\AutoIt$\
              • API String ID: 1004883554-2276155026
              • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
              • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
              • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
              • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
              APIs
                • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
              • Sleep.KERNEL32(0000000A), ref: 00409870
              • timeGetTime.WINMM ref: 00409880
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BuffCharSleepTimeUpper_wcslentime
              • String ID:
              • API String ID: 3219444185-0
              • Opcode ID: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
              • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
              • Opcode Fuzzy Hash: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
              • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A

              Control-flow Graph

              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __fread_nolock$_fseek_wcscpy
              • String ID: FILE
              • API String ID: 3888824918-3121273764
              • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
              • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
              • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
              • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

              Control-flow Graph

              APIs
              • GetSysColorBrush.USER32 ref: 00410326
              • RegisterClassExW.USER32 ref: 00410359
              • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
              • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
              • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
              • ImageList_ReplaceIcon.COMCTL32(00C91850,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
              • API String ID: 2914291525-1005189915
              • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
              • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
              • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
              • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

              Control-flow Graph

              APIs
              • GetSysColorBrush.USER32(0000000F), ref: 004101F9
              • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
              • LoadIconW.USER32(?,00000063), ref: 0041021F
              • LoadIconW.USER32(?,000000A4), ref: 00410232
              • LoadIconW.USER32(?,000000A2), ref: 00410245
              • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
              • RegisterClassExW.USER32 ref: 004102C6
                • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00C91850,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
              • String ID: #$0$PGH
              • API String ID: 423443420-3673556320
              • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
              • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
              • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
              • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

              Control-flow Graph

              APIs
              • _fseek.LIBCMT ref: 004525DA
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
              • __fread_nolock.LIBCMT ref: 00452618
              • __fread_nolock.LIBCMT ref: 00452629
              • __fread_nolock.LIBCMT ref: 00452644
              • __fread_nolock.LIBCMT ref: 00452661
              • _fseek.LIBCMT ref: 0045267D
              • _malloc.LIBCMT ref: 00452689
              • _malloc.LIBCMT ref: 00452696
              • __fread_nolock.LIBCMT ref: 004526A7
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __fread_nolock$_fseek_malloc_wcscpy
              • String ID:
              • API String ID: 1911931848-0
              • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
              • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
              • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
              • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1344 40f450-40f45c call 425210 1347 40f460-40f478 1344->1347 1347->1347 1348 40f47a-40f4a8 call 413990 call 410f70 1347->1348 1353 40f4b0-40f4d1 call 4151b0 1348->1353 1356 40f531 1353->1356 1357 40f4d3-40f4da 1353->1357 1360 40f536-40f540 1356->1360 1358 40f4dc-40f4de 1357->1358 1359 40f4fd-40f517 call 41557c 1357->1359 1361 40f4e0-40f4e2 1358->1361 1364 40f51c-40f51f 1359->1364 1363 40f4e6-40f4ed 1361->1363 1365 40f521-40f52c 1363->1365 1366 40f4ef-40f4f2 1363->1366 1364->1353 1369 40f543-40f54e 1365->1369 1370 40f52e-40f52f 1365->1370 1367 42937a-4293a0 call 41557c call 4151b0 1366->1367 1368 40f4f8-40f4fb 1366->1368 1381 4293a5-4293c3 call 4151d0 1367->1381 1368->1359 1368->1361 1372 40f550-40f553 1369->1372 1373 40f555-40f560 1369->1373 1370->1366 1372->1366 1374 429372 1373->1374 1375 40f566-40f571 1373->1375 1374->1367 1377 429361-429367 1375->1377 1378 40f577-40f57a 1375->1378 1377->1363 1380 42936d 1377->1380 1378->1366 1380->1374 1381->1360
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __fread_nolock_fseek_strcat
              • String ID: AU3!$EA06
              • API String ID: 3818483258-2658333250
              • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
              • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
              • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
              • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1384 410130-410142 SHGetMalloc 1385 410148-410158 SHGetDesktopFolder 1384->1385 1386 42944f-429459 call 411691 1384->1386 1387 4101d1-4101e0 1385->1387 1388 41015a-410188 call 411691 1385->1388 1387->1386 1394 4101e6-4101ee 1387->1394 1396 4101c5-4101ce 1388->1396 1397 41018a-4101a1 SHGetPathFromIDListW 1388->1397 1396->1387 1398 4101a3-4101b1 call 411691 1397->1398 1399 4101b4-4101c0 1397->1399 1398->1399 1399->1396
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscpy$DesktopFolderFromListMallocPath
              • String ID: C:\Users\user\Desktop\Payment confirmaton copy.exe
              • API String ID: 192938534-4055014379
              • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
              • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
              • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
              • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1402 401230-40123b 1403 401241-401272 call 4131f0 call 401be0 1402->1403 1404 4012c5-4012cd 1402->1404 1409 401274-401292 1403->1409 1410 4012ae-4012bf KillTimer SetTimer 1403->1410 1411 42aa61-42aa67 1409->1411 1412 401298-40129c 1409->1412 1410->1404 1415 42aa8b-42aaa7 Shell_NotifyIconW 1411->1415 1416 42aa69-42aa86 Shell_NotifyIconW 1411->1416 1413 4012a2-4012a8 1412->1413 1414 42aaac-42aab3 1412->1414 1413->1410 1417 42aaf8-42ab15 Shell_NotifyIconW 1413->1417 1418 42aad7-42aaf3 Shell_NotifyIconW 1414->1418 1419 42aab5-42aad2 Shell_NotifyIconW 1414->1419 1415->1410 1416->1410 1417->1410 1418->1410 1419->1410
              APIs
              • _memset.LIBCMT ref: 00401257
                • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
              • KillTimer.USER32(?,?), ref: 004012B0
              • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
              • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
              • String ID:
              • API String ID: 1792922140-0
              • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
              • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
              • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
              • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1420 400c638-400c6e6 call 400a068 1423 400c6ed-400c713 call 400d548 CreateFileW 1420->1423 1426 400c715 1423->1426 1427 400c71a-400c72a 1423->1427 1428 400c865-400c869 1426->1428 1432 400c731-400c74b VirtualAlloc 1427->1432 1433 400c72c 1427->1433 1430 400c8ab-400c8ae 1428->1430 1431 400c86b-400c86f 1428->1431 1434 400c8b1-400c8b8 1430->1434 1435 400c871-400c874 1431->1435 1436 400c87b-400c87f 1431->1436 1439 400c752-400c769 ReadFile 1432->1439 1440 400c74d 1432->1440 1433->1428 1441 400c8ba-400c8c5 1434->1441 1442 400c90d-400c922 1434->1442 1435->1436 1437 400c881-400c88b 1436->1437 1438 400c88f-400c893 1436->1438 1437->1438 1445 400c8a3 1438->1445 1446 400c895-400c89f 1438->1446 1447 400c770-400c7b0 VirtualAlloc 1439->1447 1448 400c76b 1439->1448 1440->1428 1449 400c8c7 1441->1449 1450 400c8c9-400c8d5 1441->1450 1443 400c932-400c93a 1442->1443 1444 400c924-400c92f VirtualFree 1442->1444 1444->1443 1445->1430 1446->1445 1451 400c7b2 1447->1451 1452 400c7b7-400c7d2 call 400d798 1447->1452 1448->1428 1449->1442 1453 400c8d7-400c8e7 1450->1453 1454 400c8e9-400c8f5 1450->1454 1451->1428 1460 400c7dd-400c7e7 1452->1460 1456 400c90b 1453->1456 1457 400c902-400c908 1454->1457 1458 400c8f7-400c900 1454->1458 1456->1434 1457->1456 1458->1456 1461 400c7e9-400c818 call 400d798 1460->1461 1462 400c81a-400c82e call 400d5a8 1460->1462 1461->1460 1468 400c830 1462->1468 1469 400c832-400c836 1462->1469 1468->1428 1470 400c842-400c846 1469->1470 1471 400c838-400c83c CloseHandle 1469->1471 1472 400c856-400c85f 1470->1472 1473 400c848-400c853 VirtualFree 1470->1473 1471->1470 1472->1423 1472->1428 1473->1472
              APIs
              • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0400C709
              • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0400C92F
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateFileFreeVirtual
              • String ID:
              • API String ID: 204039940-0
              • Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
              • Instruction ID: d870fdee4b4d939e092493c9db5d84e3836c98bfc35ca08b76924e753aca7b05
              • Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
              • Instruction Fuzzy Hash: 75A10874E04209EBFB18CFA4C898BEEB7B5BF48704F208259E515BB2C0D775AA40DB55

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1474 414f10-414f2c 1475 414f4f 1474->1475 1476 414f2e-414f31 1474->1476 1477 414f51-414f55 1475->1477 1476->1475 1478 414f33-414f35 1476->1478 1479 414f37-414f46 call 417f23 1478->1479 1480 414f56-414f5b 1478->1480 1490 414f47-414f4c call 417ebb 1479->1490 1482 414f6a-414f6d 1480->1482 1483 414f5d-414f68 1480->1483 1486 414f7a-414f7c 1482->1486 1487 414f6f-414f77 call 4131f0 1482->1487 1483->1482 1485 414f8b-414f9e 1483->1485 1488 414fa0-414fa6 1485->1488 1489 414fa8 1485->1489 1486->1479 1492 414f7e-414f89 1486->1492 1487->1486 1493 414faf-414fb1 1488->1493 1489->1493 1490->1475 1492->1479 1492->1485 1496 4150a1-4150a4 1493->1496 1497 414fb7-414fbe 1493->1497 1496->1477 1499 414fc0-414fc5 1497->1499 1500 415004-415007 1497->1500 1499->1500 1501 414fc7 1499->1501 1502 415071-415072 call 41e6b1 1500->1502 1503 415009-41500d 1500->1503 1504 415102 1501->1504 1505 414fcd-414fd1 1501->1505 1516 415077-41507b 1502->1516 1507 41500f-415018 1503->1507 1508 41502e-415035 1503->1508 1511 415106-41510f 1504->1511 1514 414fd3 1505->1514 1515 414fd5-414fd8 1505->1515 1509 415023-415028 1507->1509 1510 41501a-415021 1507->1510 1512 415037 1508->1512 1513 415039-41503c 1508->1513 1518 41502a-41502c 1509->1518 1510->1518 1511->1477 1512->1513 1519 415042-41504e call 41453a call 41ed9e 1513->1519 1520 4150d5-4150d9 1513->1520 1514->1515 1521 4150a9-4150af 1515->1521 1522 414fde-414fff call 41ee9b 1515->1522 1516->1511 1517 415081-415085 1516->1517 1517->1520 1523 415087-415096 1517->1523 1518->1513 1542 415053-415058 1519->1542 1528 4150eb-4150fd call 417f23 1520->1528 1529 4150db-4150e8 call 4131f0 1520->1529 1524 4150b1-4150bd call 4131f0 1521->1524 1525 4150c0-4150d0 call 417f23 1521->1525 1531 415099-41509b 1522->1531 1523->1531 1524->1525 1525->1490 1528->1490 1529->1528 1531->1496 1531->1497 1543 415114-415118 1542->1543 1544 41505e-415061 1542->1544 1543->1511 1544->1504 1545 415067-41506f 1544->1545 1545->1531
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
              • String ID:
              • API String ID: 3886058894-0
              • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
              • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
              • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
              • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1546 401be0-401bf5 1547 401bfb-401c12 call 4013a0 1546->1547 1548 401cde-401ce3 1546->1548 1551 42a9a0-42a9b0 LoadStringW 1547->1551 1552 401c18-401c34 call 4021e0 1547->1552 1554 42a9bb-42a9c8 call 40df50 1551->1554 1557 401c3a-401c3e 1552->1557 1558 42a9cd-42a9ea call 40d3b0 call 437a81 1552->1558 1562 401c53-401cd9 call 4131f0 call 41326a call 411691 Shell_NotifyIconW call 402620 1554->1562 1557->1554 1560 401c44-401c4e call 40d3b0 1557->1560 1558->1562 1570 42a9f0-42aa04 call 40d3b0 call 437a81 1558->1570 1560->1562 1562->1548
              APIs
              • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • _memset.LIBCMT ref: 00401C62
              • _wcsncpy.LIBCMT ref: 00401CA1
              • _wcscpy.LIBCMT ref: 00401CBD
              • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
              • String ID: Line:
              • API String ID: 1620655955-1585850449
              • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
              • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
              • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
              • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1579 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
              APIs
              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
              • ShowWindow.USER32(?,00000000), ref: 00410454
              • ShowWindow.USER32(?,00000000), ref: 0041045E
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$CreateShow
              • String ID: AutoIt v3$edit
              • API String ID: 1584632944-3779509399
              • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
              • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
              • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
              • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1580 400c418-400c530 call 400a068 call 400c308 CreateFileW 1587 400c532 1580->1587 1588 400c537-400c547 1580->1588 1589 400c5e7-400c5ec 1587->1589 1591 400c549 1588->1591 1592 400c54e-400c568 VirtualAlloc 1588->1592 1591->1589 1593 400c56a 1592->1593 1594 400c56c-400c583 ReadFile 1592->1594 1593->1589 1595 400c585 1594->1595 1596 400c587-400c5c1 call 400c348 call 400b308 1594->1596 1595->1589 1601 400c5c3-400c5d8 call 400c398 1596->1601 1602 400c5dd-400c5e5 ExitProcess 1596->1602 1601->1602 1602->1589
              APIs
                • Part of subcall function 0400C308: Sleep.KERNELBASE(000001F4), ref: 0400C319
              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400C526
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateFileSleep
              • String ID: A669958VRXEXDLF2U7
              • API String ID: 2694422964-3282117854
              • Opcode ID: c4846231277ce563c0e6544c6d60ca253c8d2a456a35de3486681d641cfbc15e
              • Instruction ID: 0028f7bdfe299133f0fd59eba0e54cb5232018d147376fa20184e9e0b19862d3
              • Opcode Fuzzy Hash: c4846231277ce563c0e6544c6d60ca253c8d2a456a35de3486681d641cfbc15e
              • Instruction Fuzzy Hash: 2F517331D14248DBFF15DBA4C814BEEBB78AF09305F008199E649BB2C0D7795B49CB65
              APIs
              • __lock.LIBCMT ref: 00413AA6
                • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
              • ___sbh_find_block.LIBCMT ref: 00413AB1
              • ___sbh_free_block.LIBCMT ref: 00413AC0
              • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
              • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
              • String ID:
              • API String ID: 2714421763-0
              • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
              • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
              • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
              • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: Wu
              • API String ID: 0-4083010176
              • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
              • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
              • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
              • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
              APIs
                • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
              • _strcat.LIBCMT ref: 0040F603
                • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
              • String ID: HH
              • API String ID: 1194219731-2761332787
              • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
              • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
              • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
              • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
              APIs
              • CreateProcessW.KERNELBASE(?,00000000), ref: 0400BAC3
              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0400BB59
              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0400BB7B
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$ContextCreateMemoryReadThreadWow64
              • String ID:
              • API String ID: 2438371351-0
              • Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
              • Instruction ID: bb6bfdc2af045da4cc63e4daea2c128303e943fbc9aadcc0fa225f763eacd0c1
              • Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
              • Instruction Fuzzy Hash: 1D62EA30A146589BEB24CFA4C850BDEB376EF58304F1091A9D20DFB2D4E775AE81CB59
              APIs
              • _memset.LIBCMT ref: 0040E202
              • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: IconNotifyShell__memset
              • String ID:
              • API String ID: 928536360-0
              • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
              • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
              • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
              • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
              APIs
              • _malloc.LIBCMT ref: 00411734
                • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
              • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
              • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
              • __CxxThrowException@8.LIBCMT ref: 00411779
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
              • String ID:
              • API String ID: 1411284514-0
              • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
              • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
              • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
              • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
              APIs
              • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
              • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
              • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseOpenQueryValue
              • String ID:
              • API String ID: 3677997916-0
              • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
              • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
              • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
              • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
              APIs
              • _malloc.LIBCMT ref: 00435278
                • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
              • _malloc.LIBCMT ref: 00435288
              • _malloc.LIBCMT ref: 00435298
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _malloc$AllocateHeap
              • String ID:
              • API String ID: 680241177-0
              • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
              • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
              • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
              • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClearVariant
              • String ID:
              • API String ID: 1473721057-0
              • Opcode ID: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
              • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
              • Opcode Fuzzy Hash: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
              • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
              APIs
              • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
              • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateFile
              • String ID:
              • API String ID: 823142352-0
              • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
              • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
              • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
              • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __lock_file_memset
              • String ID:
              • API String ID: 26237723-0
              • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
              • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
              • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
              • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
              APIs
                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
              • __lock_file.LIBCMT ref: 00414EE4
                • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
              • __fclose_nolock.LIBCMT ref: 00414EEE
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
              • String ID:
              • API String ID: 717694121-0
              • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
              • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
              • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
              • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
              APIs
              • TranslateMessage.USER32(?), ref: 004098F6
              • DispatchMessageW.USER32(?), ref: 00409901
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Message$DispatchTranslate
              • String ID:
              • API String ID: 1706434739-0
              • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
              • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
              • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
              • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
              APIs
              • TranslateMessage.USER32(?), ref: 004098F6
              • DispatchMessageW.USER32(?), ref: 00409901
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Message$DispatchTranslate
              • String ID:
              • API String ID: 1706434739-0
              • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
              • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
              • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
              • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
              APIs
              • CreateProcessW.KERNELBASE(?,00000000), ref: 0400BAC3
              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0400BB59
              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0400BB7B
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$ContextCreateMemoryReadThreadWow64
              • String ID:
              • API String ID: 2438371351-0
              • Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
              • Instruction ID: 7f9998a7d29c1dc05e1112976889b94d0cf92e1a4103f4d15fd46a374225dc6a
              • Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
              • Instruction Fuzzy Hash: 3912DF24E14658C6EB24DF64D8507DEB272EF68300F1090E9910DEB7A4E77A5F81CF5A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ProtectVirtual
              • String ID:
              • API String ID: 544645111-0
              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
              • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
              • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
              • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
              • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
              • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
              APIs
              • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ProcWindow
              • String ID:
              • API String ID: 181713994-0
              • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
              • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
              • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
              • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
              APIs
              • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateHeap
              • String ID:
              • API String ID: 10892065-0
              • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
              • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
              • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
              • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
              APIs
                • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
              • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: File$PointerWrite
              • String ID:
              • API String ID: 539440098-0
              • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
              • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
              • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
              • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
              APIs
              • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ProcWindow
              • String ID:
              • API String ID: 181713994-0
              • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
              • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
              • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
              • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wfsopen
              • String ID:
              • API String ID: 197181222-0
              • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
              • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
              • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
              • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
              APIs
              • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseHandle
              • String ID:
              • API String ID: 2962429428-0
              • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
              • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
              • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
              • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
              APIs
              • Sleep.KERNELBASE(000001F4), ref: 0400C319
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Sleep
              • String ID:
              • API String ID: 3472027048-0
              • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
              • Instruction ID: 8f156f2671edaf0b0819e2b094a8b9a657db64fa776cd80421a216259a3a27f5
              • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
              • Instruction Fuzzy Hash: B5E0BF7494510DEFDB10DFA4D5496DD7BB4EF04301F1046A1FD05E7680DB309E548A62
              APIs
              • Sleep.KERNELBASE(000001F4), ref: 0400C319
              Memory Dump Source
              • Source File: 00000000.00000002.1626608117.000000000400A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0400A000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400a000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Sleep
              • String ID:
              • API String ID: 3472027048-0
              • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
              • Instruction ID: 58fb4e0abe8fb5e1ac28566542cdaac875c6dc27d2f544ea2401a5bf15052b1d
              • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
              • Instruction Fuzzy Hash: 17E0E67494510DDFDB00DFB4D5496DD7FB4EF04301F104661FD01E2280D6309E508A62
              APIs
              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
              • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
              • GetKeyState.USER32(00000011), ref: 0047C1A4
              • GetKeyState.USER32(00000009), ref: 0047C1AD
              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
              • GetKeyState.USER32(00000010), ref: 0047C1CA
              • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
              • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
              • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
              • SendMessageW.USER32 ref: 0047C2FB
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$State$LongProcWindow
              • String ID: @GUI_DRAGID$F
              • API String ID: 1562745308-4164748364
              • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
              • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
              • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
              • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
              • API String ID: 0-3772701627
              • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
              • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
              • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
              • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
              APIs
              • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
              • IsIconic.USER32(?), ref: 004375E1
              • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
              • SetForegroundWindow.USER32(?), ref: 004375FD
              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
              • GetCurrentThreadId.KERNEL32 ref: 00437619
              • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
              • SetForegroundWindow.USER32(?), ref: 00437645
              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
              • keybd_event.USER32(00000012,00000000), ref: 0043765D
              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
              • keybd_event.USER32(00000012,00000000), ref: 00437674
              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
              • keybd_event.USER32(00000012,00000000), ref: 0043768B
              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
              • keybd_event.USER32(00000012,00000000), ref: 004376A2
              • SetForegroundWindow.USER32(?), ref: 004376AD
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
              • String ID: Shell_TrayWnd
              • API String ID: 3778422247-2988720461
              • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
              • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
              • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
              • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
              APIs
              • _memset.LIBCMT ref: 0044621B
              • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
              • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
              • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
              • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
              • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
              • _wcslen.LIBCMT ref: 0044639E
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • _wcsncpy.LIBCMT ref: 004463C7
              • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
              • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
              • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
              • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
              • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
              • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
              • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
              • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
              • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
              • String ID: $default$winsta0
              • API String ID: 2173856841-1027155976
              • Opcode ID: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
              • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
              • Opcode Fuzzy Hash: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
              • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
              APIs
                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment confirmaton copy.exe,?,C:\Users\user\Desktop\Payment confirmaton copy.exe,004A8E80,C:\Users\user\Desktop\Payment confirmaton copy.exe,0040F3D2), ref: 0040FFCA
                • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
              • _wcscat.LIBCMT ref: 0044BD96
              • _wcscat.LIBCMT ref: 0044BDBF
              • __wsplitpath.LIBCMT ref: 0044BDEC
              • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
              • _wcscpy.LIBCMT ref: 0044BE73
              • _wcscat.LIBCMT ref: 0044BE85
              • _wcscat.LIBCMT ref: 0044BE97
              • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
              • DeleteFileW.KERNEL32(?), ref: 0044BED5
              • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
              • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
              • DeleteFileW.KERNEL32(?), ref: 0044BF17
              • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
              • FindClose.KERNEL32(00000000), ref: 0044BF35
              • MoveFileW.KERNEL32(?,?), ref: 0044BF51
              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
              • FindClose.KERNEL32(00000000), ref: 0044BF7E
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
              • String ID: \*.*
              • API String ID: 2188072990-1173974218
              • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
              • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
              • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
              • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
              APIs
              • __invoke_watson.LIBCMT ref: 004203A4
                • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
              • __get_daylight.LIBCMT ref: 004203B0
              • __invoke_watson.LIBCMT ref: 004203BF
              • __get_daylight.LIBCMT ref: 004203CB
              • __invoke_watson.LIBCMT ref: 004203DA
              • ____lc_codepage_func.LIBCMT ref: 004203E2
              • _strlen.LIBCMT ref: 00420442
              • __malloc_crt.LIBCMT ref: 00420449
              • _strlen.LIBCMT ref: 0042045F
              • _strcpy_s.LIBCMT ref: 0042046D
              • __invoke_watson.LIBCMT ref: 00420482
              • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
              • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
              • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
              • __invoke_watson.LIBCMT ref: 004205CC
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
              • String ID: S\
              • API String ID: 4084823496-393906132
              • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
              • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
              • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
              • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
              APIs
              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
              • __swprintf.LIBCMT ref: 00434D91
              • _wcslen.LIBCMT ref: 00434D9B
              • _wcslen.LIBCMT ref: 00434DB0
              • _wcslen.LIBCMT ref: 00434DC5
              • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
              • _memset.LIBCMT ref: 00434E27
              • _wcslen.LIBCMT ref: 00434E3C
              • _wcsncpy.LIBCMT ref: 00434E6F
              • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
              • CloseHandle.KERNEL32(00000000), ref: 00434EB4
              • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
              • CloseHandle.KERNEL32(00000000), ref: 00434ECE
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
              • String ID: :$\$\??\%s
              • API String ID: 302090198-3457252023
              • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
              • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
              • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
              • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
              APIs
                • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
              • GetLastError.KERNEL32 ref: 004644B4
              • GetCurrentThread.KERNEL32 ref: 004644C8
              • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
              • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
              • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
              • String ID: SeDebugPrivilege
              • API String ID: 1312810259-2896544425
              • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
              • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
              • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
              • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
              • __wsplitpath.LIBCMT ref: 004038B2
                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
              • _wcscpy.LIBCMT ref: 004038C7
              • _wcscat.LIBCMT ref: 004038DC
              • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
              • _wcscpy.LIBCMT ref: 004039C2
              • _wcslen.LIBCMT ref: 00403A53
              • _wcslen.LIBCMT ref: 00403AAA
              Strings
              • _, xrefs: 00403B48
              • Unterminated string, xrefs: 0042B9BA
              • Error opening the file, xrefs: 0042B8AC
              • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
              • API String ID: 4115725249-188983378
              • Opcode ID: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
              • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
              • Opcode Fuzzy Hash: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
              • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
              APIs
              • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
              • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
              • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
              • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
              • FindClose.KERNEL32(00000000), ref: 00434C88
              • FindClose.KERNEL32(00000000), ref: 00434C9C
              • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
              • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
              • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
              • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
              • FindClose.KERNEL32(00000000), ref: 00434D35
              • FindClose.KERNEL32(00000000), ref: 00434D43
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
              • String ID: *.*
              • API String ID: 1409584000-438819550
              • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
              • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
              • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
              • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Timetime$Sleep
              • String ID: BUTTON
              • API String ID: 4176159691-3405671355
              • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
              • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
              • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
              • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
              APIs
                • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
              • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
              • _memset.LIBCMT ref: 00445E61
              • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
              • GetLengthSid.ADVAPI32(?), ref: 00445E92
              • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
              • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
              • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
              • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
              • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
              • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
              • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
              • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
              • String ID:
              • API String ID: 3490752873-0
              • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
              • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
              • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
              • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
              APIs
              • OleInitialize.OLE32(00000000), ref: 0047AA03
              • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
              • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
              • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
              • _memset.LIBCMT ref: 0047AB7C
              • _wcslen.LIBCMT ref: 0047AC68
              • _memset.LIBCMT ref: 0047ACCD
              • CoCreateInstanceEx.OLE32 ref: 0047AD06
              • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
              Strings
              • NULL Pointer assignment, xrefs: 0047AD84
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
              • String ID: NULL Pointer assignment
              • API String ID: 1588287285-2785691316
              • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
              • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
              • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
              • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
              APIs
              • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
              • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
              • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
              • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
              • GetLastError.KERNEL32 ref: 00436504
              • ExitWindowsEx.USER32(?,00000000), ref: 00436527
              • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
              • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
              • String ID: SeShutdownPrivilege
              • API String ID: 2938487562-3733053543
              • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
              • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
              • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
              • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
              APIs
              • __swprintf.LIBCMT ref: 00436162
              • __swprintf.LIBCMT ref: 00436176
                • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
              • __wcsicoll.LIBCMT ref: 00436185
              • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
              • LoadResource.KERNEL32(?,00000000), ref: 004361AE
              • LockResource.KERNEL32(00000000), ref: 004361B5
              • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
              • LoadResource.KERNEL32(?,00000000), ref: 004361E4
              • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
              • LockResource.KERNEL32(?), ref: 004361FD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
              • String ID:
              • API String ID: 2406429042-0
              • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
              • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
              • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
              • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
              APIs
              • SetErrorMode.KERNEL32(00000001), ref: 0045D522
              • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
              • GetLastError.KERNEL32 ref: 0045D59D
              • SetErrorMode.KERNEL32(?), ref: 0045D629
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Error$Mode$DiskFreeLastSpace
              • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
              • API String ID: 4194297153-14809454
              • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
              • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
              • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
              • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
              APIs
              • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
              • OleInitialize.OLE32(00000000), ref: 0047AE06
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • _wcslen.LIBCMT ref: 0047AE18
              • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
              • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
              • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
              • String ID: HH
              • API String ID: 1915432386-2761332787
              • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
              • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
              • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
              • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: DEFINE$`$h$h
              • API String ID: 0-4194577831
              • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
              • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
              • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
              • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
              APIs
              • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
              • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
              • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
              • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
              • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLast$bindclosesocketsocket
              • String ID:
              • API String ID: 2609815416-0
              • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
              • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
              • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
              • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
              APIs
              • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
              • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
              • Process32NextW.KERNEL32(00000000,?), ref: 00437075
              • __wsplitpath.LIBCMT ref: 004370A5
                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
              • _wcscat.LIBCMT ref: 004370BA
              • __wcsicoll.LIBCMT ref: 004370C8
              • CloseHandle.KERNEL32(00000000,?), ref: 00437105
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
              • String ID:
              • API String ID: 2547909840-0
              • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
              • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
              • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
              • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
              • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
              • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
              • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Find$File$CloseFirstNextSleep_wcslen
              • String ID: *.*
              • API String ID: 2693929171-438819550
              • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
              • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
              • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
              • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
              APIs
              • OpenClipboard.USER32(?), ref: 0046C635
              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
              • GetClipboardData.USER32(0000000D), ref: 0046C64F
              • CloseClipboard.USER32 ref: 0046C65D
              • GlobalLock.KERNEL32(00000000), ref: 0046C688
              • CloseClipboard.USER32 ref: 0046C692
              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
              • GetClipboardData.USER32(00000001), ref: 0046C6DD
              • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
              • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
              • CloseClipboard.USER32 ref: 0046C866
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
              • String ID: HH
              • API String ID: 589737431-2761332787
              • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
              • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
              • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
              • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
              APIs
              • __wcsicoll.LIBCMT ref: 0043643C
              • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
              • __wcsicoll.LIBCMT ref: 00436466
              • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicollmouse_event
              • String ID: DOWN
              • API String ID: 1033544147-711622031
              • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
              • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
              • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
              • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
              APIs
                • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
              • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
              • WSAGetLastError.WSOCK32(00000000), ref: 00474233
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLastinet_addrsocket
              • String ID:
              • API String ID: 4170576061-0
              • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
              • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
              • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
              • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
              APIs
              • GetCursorPos.USER32(004A83D8), ref: 0045636A
              • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
              • GetAsyncKeyState.USER32(?), ref: 004563D0
              • GetAsyncKeyState.USER32(?), ref: 004563DC
              • GetWindowLongW.USER32(?,000000F0), ref: 00456430
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AsyncState$ClientCursorLongScreenWindow
              • String ID:
              • API String ID: 3539004672-0
              • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
              • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
              • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
              • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
              APIs
                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
              • IsWindowVisible.USER32 ref: 00477314
              • IsWindowEnabled.USER32 ref: 00477324
              • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
              • IsIconic.USER32 ref: 0047733F
              • IsZoomed.USER32 ref: 0047734D
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$EnabledForegroundIconicVisibleZoomed
              • String ID:
              • API String ID: 292994002-0
              • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
              • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
              • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
              • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
              APIs
              • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75573220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
              • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: File$CloseCreateHandleTime
              • String ID:
              • API String ID: 3397143404-0
              • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
              • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
              • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
              • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _strncmp
              • String ID: ACCEPT$^$h
              • API String ID: 909875538-4263704089
              • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
              • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
              • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
              • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
              APIs
              • _set_new_mode.LIBCMT ref: 0040D88C
              • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D8B9
              • FreeLibrary.KERNEL32(?), ref: 0040D8CE
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FreeInfoLibraryParametersSystem_set_new_mode
              • String ID: Wu
              • API String ID: 1188159508-4083010176
              • Opcode ID: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
              • Instruction ID: 2b4412acdce639bfbf0f9e0c9ecf3f694f94d165ded01d265c3c64edb54a61d9
              • Opcode Fuzzy Hash: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
              • Instruction Fuzzy Hash: C2215EB19183009FC700EF56D88150ABBE4FB98354F44497EF849A72A2D735A945CB9A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: ERCP$VUUU$VUUU$VUUU
              • API String ID: 0-2165971703
              • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
              • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
              • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
              • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
              APIs
              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
              • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
              • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Find$File$CloseFirstNext
              • String ID:
              • API String ID: 3541575487-0
              • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
              • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
              • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
              • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
              APIs
              • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
              • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
              • FindClose.KERNEL32(00000000), ref: 00436B13
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FileFind$AttributesCloseFirst
              • String ID:
              • API String ID: 48322524-0
              • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
              • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
              • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
              • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
              APIs
              • __time64.LIBCMT ref: 004433A2
                • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Time$FileSystem__aulldiv__time64
              • String ID: rJ
              • API String ID: 2893107130-1865492326
              • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
              • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
              • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
              • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
              APIs
              • __time64.LIBCMT ref: 004433A2
                • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Time$FileSystem__aulldiv__time64
              • String ID: rJ
              • API String ID: 2893107130-1865492326
              • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
              • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
              • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
              • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
              APIs
              • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
              • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Internet$AvailableDataErrorFileLastQueryRead
              • String ID:
              • API String ID: 901099227-0
              • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
              • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
              • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
              • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
              APIs
              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
              • FindClose.KERNEL32(00000000), ref: 0045DDDD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Find$CloseFileFirst
              • String ID:
              • API String ID: 2295610775-0
              • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
              • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
              • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
              • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: 0vH$HH
              • API String ID: 0-728391547
              • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
              • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
              • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
              • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _memset
              • String ID:
              • API String ID: 2102423945-0
              • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
              • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
              • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
              • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
              APIs
              • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Proc
              • String ID:
              • API String ID: 2346855178-0
              • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
              • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
              • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
              • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
              APIs
              • BlockInput.USER32(00000001), ref: 0045A272
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BlockInput
              • String ID:
              • API String ID: 3456056419-0
              • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
              • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
              • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
              • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
              APIs
              • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: LogonUser
              • String ID:
              • API String ID: 1244722697-0
              • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
              • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
              • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
              • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: NameUser
              • String ID:
              • API String ID: 2645101109-0
              • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
              • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
              • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
              • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
              APIs
              • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ExceptionFilterUnhandled
              • String ID:
              • API String ID: 3192549508-0
              • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
              • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
              • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
              • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
              • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
              • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
              • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
              • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
              • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
              • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
              • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
              • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
              • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
              • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
              • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
              • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
              • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
              • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
              • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
              APIs
              • DeleteObject.GDI32(?), ref: 004593D7
              • DeleteObject.GDI32(?), ref: 004593F1
              • DestroyWindow.USER32(?), ref: 00459407
              • GetDesktopWindow.USER32 ref: 0045942A
              • GetWindowRect.USER32(00000000), ref: 00459431
              • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
              • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
              • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
              • GetClientRect.USER32(00000000,?), ref: 004595C8
              • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
              • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
              • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
              • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
              • GlobalLock.KERNEL32(00000000), ref: 00459668
              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
              • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
              • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
              • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
              • GlobalFree.KERNEL32(00000000), ref: 004596C0
              • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
              • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
              • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
              • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
              • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
              • GetStockObject.GDI32(00000011), ref: 004597B7
              • SelectObject.GDI32(00000000,00000000), ref: 004597BF
              • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
              • DeleteDC.GDI32(00000000), ref: 004597E1
              • _wcslen.LIBCMT ref: 00459800
              • _wcscpy.LIBCMT ref: 0045981F
              • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
              • GetDC.USER32(?), ref: 004598DE
              • SelectObject.GDI32(00000000,?), ref: 004598EE
              • SelectObject.GDI32(00000000,?), ref: 00459919
              • ReleaseDC.USER32(?,00000000), ref: 00459925
              • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
              • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
              • String ID: $AutoIt v3$DISPLAY$static
              • API String ID: 4040870279-2373415609
              • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
              • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
              • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
              • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsnicmp
              • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
              • API String ID: 1038674560-3360698832
              • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
              • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
              • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
              • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
              APIs
              • GetSysColor.USER32(0000000E), ref: 00433D81
              • SetTextColor.GDI32(?,00000000), ref: 00433D89
              • GetSysColor.USER32(00000012), ref: 00433DA3
              • SetTextColor.GDI32(?,?), ref: 00433DAB
              • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
              • GetSysColor.USER32(0000000F), ref: 00433DCB
              • CreateSolidBrush.GDI32(?), ref: 00433DD4
              • GetSysColor.USER32(00000011), ref: 00433DEB
              • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
              • SelectObject.GDI32(?,00000000), ref: 00433E0D
              • SetBkColor.GDI32(?,?), ref: 00433E19
              • SelectObject.GDI32(?,?), ref: 00433E29
              • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
              • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
              • GetWindowLongW.USER32 ref: 00433E8A
              • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
              • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
              • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
              • DrawFocusRect.USER32(?,?), ref: 00433F1F
              • GetSysColor.USER32(00000011), ref: 00433F2E
              • SetTextColor.GDI32(?,00000000), ref: 00433F36
              • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
              • SelectObject.GDI32(?,?), ref: 00433F63
              • DeleteObject.GDI32(?), ref: 00433F70
              • SelectObject.GDI32(?,?), ref: 00433F78
              • DeleteObject.GDI32(00000000), ref: 00433F7B
              • SetTextColor.GDI32(?,?), ref: 00433F83
              • SetBkColor.GDI32(?,?), ref: 00433F8F
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
              • String ID:
              • API String ID: 1582027408-0
              • Opcode ID: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
              • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
              • Opcode Fuzzy Hash: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
              • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
              APIs
              • OpenClipboard.USER32(?), ref: 0046C635
              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
              • GetClipboardData.USER32(0000000D), ref: 0046C64F
              • CloseClipboard.USER32 ref: 0046C65D
              • GlobalLock.KERNEL32(00000000), ref: 0046C688
              • CloseClipboard.USER32 ref: 0046C692
              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
              • GetClipboardData.USER32(00000001), ref: 0046C6DD
              • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
              • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
              • CloseClipboard.USER32 ref: 0046C866
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
              • String ID: HH
              • API String ID: 589737431-2761332787
              • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
              • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
              • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
              • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
              APIs
              • GetCursorPos.USER32(?), ref: 00456692
              • GetDesktopWindow.USER32 ref: 004566AA
              • GetWindowRect.USER32(00000000), ref: 004566B1
              • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
              • GetWindowLongW.USER32(?,000000F0), ref: 00456720
              • DestroyWindow.USER32(?), ref: 00456731
              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
              • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
              • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
              • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
              • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
              • IsWindowVisible.USER32(?), ref: 00456812
              • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
              • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
              • GetWindowRect.USER32(?,?), ref: 0045685C
              • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
              • GetMonitorInfoW.USER32 ref: 00456894
              • CopyRect.USER32(?,?), ref: 004568A8
              • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
              • String ID: ($,$tooltips_class32
              • API String ID: 541082891-3320066284
              • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
              • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
              • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
              • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
              APIs
              • _wcslen.LIBCMT ref: 00454DCF
              • _wcslen.LIBCMT ref: 00454DE2
              • __wcsicoll.LIBCMT ref: 00454DEF
              • _wcslen.LIBCMT ref: 00454E04
              • __wcsicoll.LIBCMT ref: 00454E11
              • _wcslen.LIBCMT ref: 00454E24
              • __wcsicoll.LIBCMT ref: 00454E31
                • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
              • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
              • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
              • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
              • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
              • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
              • FreeLibrary.KERNEL32(00000000), ref: 00454F37
              • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
              • DestroyIcon.USER32(?), ref: 00454FA2
              • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
              • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
              • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
              • String ID: .dll$.exe$.icl$Wu
              • API String ID: 2511167534-3157294790
              • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
              • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
              • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
              • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
              APIs
              • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
              • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
              • _wcslen.LIBCMT ref: 00436B79
              • _wcscpy.LIBCMT ref: 00436B9F
              • _wcscat.LIBCMT ref: 00436BC0
              • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
              • _wcscat.LIBCMT ref: 00436C2A
              • _wcscat.LIBCMT ref: 00436C31
              • __wcsicoll.LIBCMT ref: 00436C4B
              • _wcsncpy.LIBCMT ref: 00436C62
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
              • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
              • API String ID: 1503153545-1459072770
              • Opcode ID: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
              • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
              • Opcode Fuzzy Hash: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
              • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
              APIs
                • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
              • _fseek.LIBCMT ref: 004527FC
              • __wsplitpath.LIBCMT ref: 0045285C
              • _wcscpy.LIBCMT ref: 00452871
              • _wcscat.LIBCMT ref: 00452886
              • __wsplitpath.LIBCMT ref: 004528B0
              • _wcscat.LIBCMT ref: 004528C8
              • _wcscat.LIBCMT ref: 004528DD
              • __fread_nolock.LIBCMT ref: 00452914
              • __fread_nolock.LIBCMT ref: 00452925
              • __fread_nolock.LIBCMT ref: 00452944
              • __fread_nolock.LIBCMT ref: 00452955
              • __fread_nolock.LIBCMT ref: 00452976
              • __fread_nolock.LIBCMT ref: 00452987
              • __fread_nolock.LIBCMT ref: 00452998
              • __fread_nolock.LIBCMT ref: 004529A9
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
              • __fread_nolock.LIBCMT ref: 00452A39
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
              • String ID:
              • API String ID: 2054058615-0
              • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
              • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
              • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
              • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: 0
              • API String ID: 0-4108050209
              • Opcode ID: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
              • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
              • Opcode Fuzzy Hash: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
              • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
              APIs
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • GetWindowRect.USER32(?,?), ref: 004701EA
              • GetClientRect.USER32(?,?), ref: 004701FA
              • GetSystemMetrics.USER32(00000007), ref: 00470202
              • GetSystemMetrics.USER32(00000008), ref: 00470216
              • GetSystemMetrics.USER32(00000004), ref: 00470238
              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
              • GetSystemMetrics.USER32(00000007), ref: 00470273
              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
              • GetSystemMetrics.USER32(00000008), ref: 004702A8
              • GetSystemMetrics.USER32(00000004), ref: 004702CF
              • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
              • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
              • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
              • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
              • GetClientRect.USER32(?,?), ref: 00470371
              • GetStockObject.GDI32(00000011), ref: 00470391
              • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
              • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
              • String ID: AutoIt v3 GUI
              • API String ID: 867697134-248962490
              • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
              • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
              • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
              • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
              APIs
              • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window
              • String ID: 0
              • API String ID: 2353593579-4108050209
              • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
              • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
              • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
              • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
              APIs
              • GetSysColor.USER32 ref: 0044A11D
              • GetClientRect.USER32(?,?), ref: 0044A18D
              • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
              • GetWindowDC.USER32(?), ref: 0044A1B3
              • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
              • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
              • GetSysColor.USER32(0000000F), ref: 0044A1EC
              • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
              • GetSysColor.USER32(0000000F), ref: 0044A216
              • GetSysColor.USER32(00000005), ref: 0044A21E
              • GetWindowDC.USER32 ref: 0044A277
              • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
              • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
              • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
              • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
              • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
              • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
              • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
              • GetStockObject.GDI32(00000005), ref: 0044A312
              • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
              • String ID:
              • API String ID: 1744303182-0
              • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
              • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
              • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
              • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll$__wcsnicmp
              • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
              • API String ID: 790654849-1810252412
              • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
              • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
              • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
              • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: >>>AUTOIT SCRIPT<<<$\
              • API String ID: 0-1896584978
              • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
              • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
              • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
              • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: InitVariant
              • String ID:
              • API String ID: 1927566239-0
              • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
              • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
              • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
              • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
              APIs
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
              • GetForegroundWindow.USER32 ref: 0046DBA4
              • IsWindow.USER32(?), ref: 0046DBDE
              • GetDesktopWindow.USER32 ref: 0046DCB5
              • EnumChildWindows.USER32(00000000), ref: 0046DCBC
              • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
              • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
              • API String ID: 1322021666-1919597938
              • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
              • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
              • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
              • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll$IconLoad
              • String ID: blank$info$question$stop$warning
              • API String ID: 2485277191-404129466
              • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
              • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
              • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
              • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
              APIs
              • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
              • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
              • strncnt.LIBCMT ref: 00428646
              • strncnt.LIBCMT ref: 0042865A
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: strncnt$CompareErrorLastString
              • String ID:
              • API String ID: 1776594460-0
              • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
              • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
              • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
              • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
              APIs
              • LoadIconW.USER32(?,00000063), ref: 004545DA
              • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
              • SetWindowTextW.USER32(?,?), ref: 00454606
              • GetDlgItem.USER32(?,000003EA), ref: 0045461F
              • SetWindowTextW.USER32(00000000,?), ref: 00454626
              • GetDlgItem.USER32(?,000003E9), ref: 00454637
              • SetWindowTextW.USER32(00000000,?), ref: 0045463E
              • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
              • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
              • GetWindowRect.USER32(?,?), ref: 00454688
              • SetWindowTextW.USER32(?,?), ref: 004546FD
              • GetDesktopWindow.USER32 ref: 00454708
              • GetWindowRect.USER32(00000000), ref: 0045470F
              • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
              • GetClientRect.USER32(?,?), ref: 0045476F
              • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
              • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
              • String ID:
              • API String ID: 3869813825-0
              • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
              • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
              • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
              • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
              APIs
              • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
              • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
              • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
              • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
              • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
              • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
              • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
              • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
              • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
              • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
              • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
              • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
              • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
              • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
              • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
              • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
              • GetCursorInfo.USER32 ref: 00458E03
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Cursor$Load$Info
              • String ID:
              • API String ID: 2577412497-0
              • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
              • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
              • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
              • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
              APIs
              • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
              • GetFocus.USER32 ref: 004696E0
              • GetDlgCtrlID.USER32(00000000), ref: 004696EB
              • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessagePost$CtrlFocus
              • String ID: 0
              • API String ID: 1534620443-4108050209
              • Opcode ID: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
              • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
              • Opcode Fuzzy Hash: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
              • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
              APIs
              • _memset.LIBCMT ref: 00468107
              • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
              • GetMenuItemCount.USER32(?), ref: 00468227
              • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
              • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
              • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
              • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
              • GetMenuItemCount.USER32 ref: 004682DC
              • SetMenuItemInfoW.USER32 ref: 00468317
              • GetCursorPos.USER32(00000000), ref: 00468322
              • SetForegroundWindow.USER32(?), ref: 0046832D
              • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
              • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
              • String ID: 0
              • API String ID: 3993528054-4108050209
              • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
              • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
              • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
              • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
              APIs
              • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
              • SendMessageW.USER32(?), ref: 0046F34C
              • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
              • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
              • _wcscat.LIBCMT ref: 0046F3BC
              • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
              • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
              • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
              • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
              • DragFinish.SHELL32(?), ref: 0046F414
              • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
              • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
              • API String ID: 4085615965-3440237614
              • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
              • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
              • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
              • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll
              • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
              • API String ID: 3832890014-4202584635
              • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
              • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
              • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
              • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
              APIs
              • _memset.LIBCMT ref: 004669C4
              • _wcsncpy.LIBCMT ref: 00466A21
              • _wcsncpy.LIBCMT ref: 00466A4D
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • _wcstok.LIBCMT ref: 00466A90
                • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
              • _wcstok.LIBCMT ref: 00466B3F
              • _wcscpy.LIBCMT ref: 00466BC8
              • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
              • _wcslen.LIBCMT ref: 00466D1D
              • _memset.LIBCMT ref: 00466BEE
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • _wcslen.LIBCMT ref: 00466D4B
              • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
              • String ID: X$HH
              • API String ID: 3021350936-1944015008
              • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
              • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
              • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
              • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
              APIs
              • _memset.LIBCMT ref: 0045F4AE
              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
              • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
              • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: InfoItemMenu$Sleep_memset
              • String ID: 0
              • API String ID: 1504565804-4108050209
              • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
              • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
              • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
              • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
              APIs
              • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$CreateDestroy
              • String ID: ,$tooltips_class32
              • API String ID: 1109047481-3856767331
              • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
              • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
              • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
              • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
              APIs
              • _wcsncpy.LIBCMT ref: 0045CCFA
              • __wsplitpath.LIBCMT ref: 0045CD3C
              • _wcscat.LIBCMT ref: 0045CD51
              • _wcscat.LIBCMT ref: 0045CD63
              • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
              • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
              • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
              • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
              • _wcscpy.LIBCMT ref: 0045CE14
              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
              • String ID: *.*
              • API String ID: 1153243558-438819550
              • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
              • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
              • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
              • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
              APIs
              • _memset.LIBCMT ref: 00455127
              • GetMenuItemInfoW.USER32 ref: 00455146
              • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
              • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
              • GetMenuItemCount.USER32(?), ref: 004551D9
              • SetMenu.USER32(?,00000000), ref: 004551E7
              • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
              • DrawMenuBar.USER32 ref: 00455207
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
              • String ID: 0
              • API String ID: 1663942905-4108050209
              • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
              • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
              • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
              • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
              • String ID:
              • API String ID: 1481289235-0
              • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
              • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
              • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
              • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
              APIs
              • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
              • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
              • SendMessageW.USER32 ref: 0046FBAF
              • SendMessageW.USER32 ref: 0046FBE2
              • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
              • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
              • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
              • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
              • SendMessageW.USER32 ref: 0046FD00
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$IconImageList_$CreateExtractReplace
              • String ID:
              • API String ID: 2632138820-0
              • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
              • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
              • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
              • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
              APIs
              • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
              • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
              • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
              • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
              • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
              • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
              • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
              • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
              • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
              • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
              • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
              • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
              • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
              • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
              • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CursorLoad
              • String ID:
              • API String ID: 3238433803-0
              • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
              • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
              • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
              • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
              APIs
              • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
              • _wcslen.LIBCMT ref: 00460B00
              • __swprintf.LIBCMT ref: 00460B9E
              • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
              • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
              • GetDlgCtrlID.USER32(?), ref: 00460CE6
              • GetWindowRect.USER32(?,?), ref: 00460D21
              • GetParent.USER32(?), ref: 00460D40
              • ScreenToClient.USER32(00000000), ref: 00460D47
              • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
              • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
              • String ID: %s%u
              • API String ID: 1899580136-679674701
              • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
              • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
              • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
              • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
              APIs
              • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • StringFromIID.OLE32(?,?), ref: 0047D7F0
              • CoTaskMemFree.OLE32(?), ref: 0047D80A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FreeFromStringTask_wcslen$_wcscpy
              • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
              • API String ID: 2485709727-934586222
              • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
              • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
              • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
              • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
              • String ID: HH
              • API String ID: 3381189665-2761332787
              • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
              • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
              • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
              • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
              APIs
              • GetDC.USER32(00000000), ref: 00434585
              • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
              • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
              • SelectObject.GDI32(00000000,?), ref: 004345A9
              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
              • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
              • String ID: (
              • API String ID: 3300687185-3887548279
              • Opcode ID: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
              • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
              • Opcode Fuzzy Hash: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
              • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
              APIs
              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
              • __swprintf.LIBCMT ref: 0045E4D9
              • _printf.LIBCMT ref: 0045E595
              • _printf.LIBCMT ref: 0045E5B7
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: LoadString_printf$__swprintf_wcslen
              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
              • API String ID: 3590180749-2894483878
              • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
              • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
              • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
              • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
              APIs
              • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
              • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
              • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
              • DeleteObject.GDI32(?), ref: 0046F950
              • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
              • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
              • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
              • DeleteObject.GDI32(?), ref: 0046F9CF
              • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
              • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
              • DestroyIcon.USER32(?), ref: 0046FA4F
              • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
              • DeleteObject.GDI32(?), ref: 0046FA68
              • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
              • String ID:
              • API String ID: 3412594756-0
              • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
              • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
              • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
              • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
              APIs
                • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
              • GetDriveTypeW.KERNEL32 ref: 0045DA30
              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: SendString$_wcslen$BuffCharDriveLowerType
              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
              • API String ID: 4013263488-4113822522
              • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
              • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
              • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
              • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
              • String ID:
              • API String ID: 228034949-0
              • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
              • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
              • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
              • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
              APIs
              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
              • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
              • GlobalLock.KERNEL32(00000000), ref: 00433523
              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
              • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
              • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
              • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
              • GlobalFree.KERNEL32(00000000), ref: 0043357B
              • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
              • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
              • DeleteObject.GDI32(?), ref: 00433603
              • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
              • String ID:
              • API String ID: 3969911579-0
              • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
              • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
              • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
              • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
              APIs
              • GetParent.USER32 ref: 00445A8D
              • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
              • __wcsicoll.LIBCMT ref: 00445AC4
              • __wcsicoll.LIBCMT ref: 00445AE0
              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll$ClassMessageNameParentSend
              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
              • API String ID: 3125838495-3381328864
              • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
              • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
              • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
              • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CopyVariant$ErrorLast
              • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
              • API String ID: 2286883814-4206948668
              • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
              • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
              • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
              • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
              APIs
                • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
              • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
              • _wcscpy.LIBCMT ref: 00475F18
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BuffCharDriveLowerType_wcscpy_wcslen
              • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
              • API String ID: 3052893215-4176887700
              • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
              • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
              • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
              • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
              APIs
              • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
              • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
              • RegQueryValueExW.ADVAPI32 ref: 00458381
              • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
              • RegQueryValueExW.ADVAPI32 ref: 004583E8
              • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
              • RegCloseKey.ADVAPI32(?), ref: 004584BA
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
              • String ID: Version$\TypeLib$interface\
              • API String ID: 656856066-939221531
              • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
              • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
              • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
              • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
              APIs
              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
              • __swprintf.LIBCMT ref: 0045E6EE
              • _printf.LIBCMT ref: 0045E7A9
              • _printf.LIBCMT ref: 0045E7D2
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: LoadString_printf$__swprintf_wcslen
              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
              • API String ID: 3590180749-2354261254
              • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
              • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
              • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
              • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
              APIs
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • _memset.LIBCMT ref: 00458194
              • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
              • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
              • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
              • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
              • CLSIDFromString.OLE32(00000000,?), ref: 00458279
              • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
              • RegCloseKey.ADVAPI32(00000000), ref: 00458296
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
              • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
              • API String ID: 2255324689-22481851
              • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
              • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
              • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
              • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
              APIs
              • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
              • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
              • RegCloseKey.ADVAPI32(?), ref: 00458615
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
              • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
              • __wcsicoll.LIBCMT ref: 004585D6
              • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
              • RegCloseKey.ADVAPI32(?), ref: 004585F8
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
              • String ID: ($interface$interface\
              • API String ID: 2231185022-3327702407
              • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
              • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
              • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
              • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
              APIs
              • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
              • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
              • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
              • _wcscpy.LIBCMT ref: 004365F5
              • WSACleanup.WSOCK32 ref: 004365FD
              • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
              • _strcat.LIBCMT ref: 0043662F
              • _wcscpy.LIBCMT ref: 00436644
              • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
              • _wcscpy.LIBCMT ref: 00436666
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
              • String ID: 0.0.0.0
              • API String ID: 2691793716-3771769585
              • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
              • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
              • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
              • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
              APIs
              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
              • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
              • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
              • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
              • __lock.LIBCMT ref: 00416B8A
              • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
              • __lock.LIBCMT ref: 00416BAB
              • ___addlocaleref.LIBCMT ref: 00416BC9
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
              • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
              • API String ID: 1028249917-2843748187
              • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
              • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
              • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
              • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
              APIs
              • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
              • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
              • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
              • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
              • SendMessageW.USER32(?,00000402,?), ref: 0044941C
              • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
              • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$CharNext
              • String ID:
              • API String ID: 1350042424-0
              • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
              • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
              • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
              • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
              APIs
              • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
              • SetKeyboardState.USER32(?), ref: 00453C5A
              • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
              • GetKeyState.USER32(000000A0), ref: 00453C99
              • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
              • GetKeyState.USER32(000000A1), ref: 00453CDA
              • GetAsyncKeyState.USER32(00000011), ref: 00453D07
              • GetKeyState.USER32(00000011), ref: 00453D15
              • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
              • GetKeyState.USER32(00000012), ref: 00453D4D
              • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
              • GetKeyState.USER32(0000005B), ref: 00453D85
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: State$Async$Keyboard
              • String ID:
              • API String ID: 541375521-0
              • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
              • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
              • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
              • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
              APIs
              • GetDlgItem.USER32(?,00000001), ref: 00437DD7
              • GetWindowRect.USER32(00000000,?), ref: 00437DE9
              • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
              • GetDlgItem.USER32(?,00000002), ref: 00437E70
              • GetWindowRect.USER32(00000000,?), ref: 00437E82
              • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
              • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
              • GetWindowRect.USER32(00000000,?), ref: 00437EFC
              • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
              • GetDlgItem.USER32(?,000003EA), ref: 00437F55
              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
              • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$ItemMoveRect$Invalidate
              • String ID:
              • API String ID: 3096461208-0
              • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
              • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
              • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
              • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
              • String ID:
              • API String ID: 136442275-0
              • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
              • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
              • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
              • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ConnectRegistry_wcslen
              • String ID: HH
              • API String ID: 535477410-2761332787
              • Opcode ID: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
              • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
              • Opcode Fuzzy Hash: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
              • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
              APIs
              • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
              • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
              • _wcslen.LIBCMT ref: 00460502
              • CharUpperBuffW.USER32(?,00000000), ref: 00460510
              • GetClassNameW.USER32(?,?,00000400), ref: 00460589
              • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
              • GetClassNameW.USER32(?,?,00000400), ref: 00460606
              • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
              • GetWindowRect.USER32(?,?), ref: 004606AD
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
              • String ID: ThumbnailClass
              • API String ID: 4123061591-1241985126
              • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
              • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
              • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
              • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
              APIs
                • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
              • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
              • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
              • ImageList_EndDrag.COMCTL32 ref: 0046F583
              • ReleaseCapture.USER32 ref: 0046F589
              • SetWindowTextW.USER32(?,00000000), ref: 0046F620
              • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
              • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
              • API String ID: 2483343779-2060113733
              • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
              • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
              • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
              • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
              APIs
              • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
              • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
              • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
              • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
              • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
              • GetClientRect.USER32(?,?), ref: 0046FEF2
              • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
              • DestroyIcon.USER32(?), ref: 0046FFCC
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
              • String ID: 2
              • API String ID: 1331449709-450215437
              • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
              • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
              • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
              • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
              APIs
              • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
              • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
              • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
              • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
              • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
              • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
              • _memcmp.LIBCMT ref: 004394A9
              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
              Strings
              • SeIncreaseQuotaPrivilege, xrefs: 0043946A
              • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
              • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
              • API String ID: 1446985595-805462909
              • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
              • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
              • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
              • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
              APIs
              • SetErrorMode.KERNEL32(00000001), ref: 0045D848
              • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorMode$DriveType
              • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
              • API String ID: 2907320926-41864084
              • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
              • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
              • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
              • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
              APIs
              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
              • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
              • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
              • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID:
              • API String ID: 1932665248-0
              • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
              • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
              • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
              • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
              APIs
              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
              • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
              • _memset.LIBCMT ref: 004481BA
              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
              • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
              • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
              • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
              • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
              • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$LongWindow_memset
              • String ID:
              • API String ID: 830647256-0
              • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
              • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
              • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
              • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
              APIs
                • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
              • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
              • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
              • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
              • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
              • DeleteObject.GDI32(00490000), ref: 0046EB4F
              • DestroyIcon.USER32(003D004E), ref: 0046EB67
              • DeleteObject.GDI32(E405075B), ref: 0046EB7F
              • DestroyWindow.USER32(0070006D), ref: 0046EB97
              • DestroyIcon.USER32(?), ref: 0046EBBF
              • DestroyIcon.USER32(?), ref: 0046EBCD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
              • String ID:
              • API String ID: 802431696-0
              • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
              • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
              • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
              • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
              APIs
              • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
              • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
              • GetKeyState.USER32(000000A0), ref: 00444E26
              • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
              • GetKeyState.USER32(000000A1), ref: 00444E51
              • GetAsyncKeyState.USER32(00000011), ref: 00444E69
              • GetKeyState.USER32(00000011), ref: 00444E77
              • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
              • GetKeyState.USER32(00000012), ref: 00444E9D
              • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
              • GetKeyState.USER32(0000005B), ref: 00444EC3
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: State$Async$Keyboard
              • String ID:
              • API String ID: 541375521-0
              • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
              • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
              • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
              • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: HH
              • API String ID: 0-2761332787
              • Opcode ID: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
              • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
              • Opcode Fuzzy Hash: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
              • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
              APIs
              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
              • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
              • _wcslen.LIBCMT ref: 00450944
              • _wcscat.LIBCMT ref: 00450955
              • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
              • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$Window_wcscat_wcslen
              • String ID: -----$SysListView32
              • API String ID: 4008455318-3975388722
              • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
              • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
              • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
              • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
              APIs
              • _memset.LIBCMT ref: 00448625
              • CreateMenu.USER32 ref: 0044863C
              • SetMenu.USER32(?,00000000), ref: 0044864C
              • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
              • IsMenu.USER32(?), ref: 004486EB
              • CreatePopupMenu.USER32 ref: 004486F5
              • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
              • DrawMenuBar.USER32 ref: 00448742
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
              • String ID: 0
              • API String ID: 176399719-4108050209
              • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
              • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
              • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
              • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
              • GetDlgCtrlID.USER32(00000000), ref: 00469289
              • GetParent.USER32 ref: 004692A4
              • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
              • GetDlgCtrlID.USER32(00000000), ref: 004692AE
              • GetParent.USER32 ref: 004692C7
              • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$CtrlParent$_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 2040099840-1403004172
              • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
              • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
              • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
              • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
              • GetDlgCtrlID.USER32(00000000), ref: 00469483
              • GetParent.USER32 ref: 0046949E
              • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
              • GetDlgCtrlID.USER32(00000000), ref: 004694A8
              • GetParent.USER32 ref: 004694C1
              • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$CtrlParent$_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 2040099840-1403004172
              • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
              • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
              • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
              • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
              APIs
                • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
              • SendMessageW.USER32(76C223D0,00001001,00000000,00000000), ref: 00448E73
              • SendMessageW.USER32(76C223D0,00001026,00000000,00000000), ref: 00448E7E
                • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$BrushCreateDeleteObjectSolid
              • String ID:
              • API String ID: 3771399671-0
              • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
              • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
              • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
              • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: InitVariant$_malloc_wcscpy_wcslen
              • String ID:
              • API String ID: 3413494760-0
              • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
              • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
              • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
              • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
              APIs
              • GetCurrentThreadId.KERNEL32 ref: 004377D7
              • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
              • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
              • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Thread$AttachInput$Window$Process$CurrentForeground
              • String ID:
              • API String ID: 2156557900-0
              • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
              • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
              • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
              • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll
              • String ID: 0%d$DOWN$OFF
              • API String ID: 3832890014-468733193
              • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
              • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
              • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
              • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
              APIs
              • VariantInit.OLEAUT32(00000000), ref: 0045E959
              • VariantCopy.OLEAUT32(00000000), ref: 0045E963
              • VariantClear.OLEAUT32 ref: 0045E970
              • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
              • __swprintf.LIBCMT ref: 0045EB1F
              • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
              • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
              Strings
              • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
              • String ID: %4d%02d%02d%02d%02d%02d
              • API String ID: 43541914-1568723262
              • Opcode ID: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
              • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
              • Opcode Fuzzy Hash: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
              • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
              APIs
              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
              • Sleep.KERNEL32(0000000A), ref: 0042FE6E
              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DecrementInterlocked$Sleep
              • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
              • API String ID: 2250217261-3412429629
              • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
              • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
              • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
              • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
              • API String ID: 0-1603158881
              • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
              • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
              • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
              • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
              APIs
              • _memset.LIBCMT ref: 00479D1F
              • VariantInit.OLEAUT32(?), ref: 00479F06
              • VariantClear.OLEAUT32(?), ref: 00479F11
              • VariantInit.OLEAUT32(?), ref: 00479DF7
                • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
              • VariantClear.OLEAUT32(?), ref: 00479F9C
                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Variant$Copy$ClearInit$ErrorLast_memset
              • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
              • API String ID: 665237470-60002521
              • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
              • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
              • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
              • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
              APIs
              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
              • DestroyWindow.USER32(?), ref: 0042A751
              • UnregisterHotKey.USER32(?), ref: 0042A778
              • FreeLibrary.KERNEL32(?), ref: 0042A822
              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
              • String ID: close all$Wu
              • API String ID: 4174999648-1790509019
              • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
              • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
              • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
              • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ConnectRegistry_wcslen
              • String ID: HH
              • API String ID: 535477410-2761332787
              • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
              • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
              • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
              • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
              APIs
              • _memset.LIBCMT ref: 0045F317
              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
              • IsMenu.USER32(?), ref: 0045F380
              • CreatePopupMenu.USER32 ref: 0045F3C5
              • GetMenuItemCount.USER32(?), ref: 0045F42F
              • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
              • String ID: 0$2
              • API String ID: 3311875123-3793063076
              • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
              • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
              • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
              • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
              APIs
              • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\Payment confirmaton copy.exe), ref: 0043719E
              • LoadStringW.USER32(00000000), ref: 004371A7
              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
              • LoadStringW.USER32(00000000), ref: 004371C0
              • _printf.LIBCMT ref: 004371EC
              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
              Strings
              • C:\Users\user\Desktop\Payment confirmaton copy.exe, xrefs: 00437189
              • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: HandleLoadModuleString$Message_printf
              • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\Payment confirmaton copy.exe
              • API String ID: 220974073-2171895394
              • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
              • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
              • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
              • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
              • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
              • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
              • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
              APIs
                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment confirmaton copy.exe,?,C:\Users\user\Desktop\Payment confirmaton copy.exe,004A8E80,C:\Users\user\Desktop\Payment confirmaton copy.exe,0040F3D2), ref: 0040FFCA
                • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
              • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
              • MoveFileW.KERNEL32(?,?), ref: 0045358E
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: File$AttributesFullMoveNamePathlstrcmpi
              • String ID:
              • API String ID: 978794511-0
              • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
              • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
              • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
              • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
              • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
              • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
              • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
              APIs
                • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
              • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
              • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
              • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
              • Sleep.KERNEL32(00000000), ref: 00445D70
              • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
              • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
              • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
              • String ID:
              • API String ID: 2014098862-0
              • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
              • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
              • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
              • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressProc_malloc$_strcat_strlen
              • String ID: AU3_FreeVar
              • API String ID: 2184576858-771828931
              • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
              • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
              • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
              • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
              APIs
              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
              • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
              • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
              • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
              • String ID:
              • API String ID: 1291720006-3916222277
              • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
              • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
              • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
              • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLastselect
              • String ID: HH
              • API String ID: 215497628-2761332787
              • Opcode ID: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
              • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
              • Opcode Fuzzy Hash: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
              • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __snwprintf__wcsicoll_wcscpy
              • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
              • API String ID: 1729044348-3708979750
              • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
              • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
              • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
              • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
              APIs
                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment confirmaton copy.exe,?,C:\Users\user\Desktop\Payment confirmaton copy.exe,004A8E80,C:\Users\user\Desktop\Payment confirmaton copy.exe,0040F3D2), ref: 0040FFCA
              • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
              • MoveFileW.KERNEL32(?,?), ref: 0044BC38
              • _wcscat.LIBCMT ref: 0044BCAA
              • _wcslen.LIBCMT ref: 0044BCB7
              • _wcslen.LIBCMT ref: 0044BCCB
              • SHFileOperationW.SHELL32 ref: 0044BD16
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
              • String ID: \*.*
              • API String ID: 2326526234-1173974218
              • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
              • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
              • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
              • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
              APIs
                • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
              • _wcslen.LIBCMT ref: 004366DD
              • GetFileAttributesW.KERNEL32(?), ref: 00436700
              • GetLastError.KERNEL32 ref: 0043670F
              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
              • _wcsrchr.LIBCMT ref: 0043674C
                • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
              • String ID: \
              • API String ID: 321622961-2967466578
              • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
              • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
              • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
              • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsnicmp
              • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
              • API String ID: 1038674560-2734436370
              • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
              • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
              • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
              • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
              APIs
              • DeleteObject.GDI32(?), ref: 0044157D
              • GetDC.USER32(00000000), ref: 00441585
              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
              • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
              • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
              • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
              • String ID:
              • API String ID: 3864802216-0
              • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
              • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
              • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
              • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
              APIs
              • ___set_flsgetvalue.LIBCMT ref: 004140E1
                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
              • ___fls_getvalue@4.LIBCMT ref: 004140EC
                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
              • ___fls_setvalue@8.LIBCMT ref: 004140FF
                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
              • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
              • ExitThread.KERNEL32 ref: 0041410F
              • GetCurrentThreadId.KERNEL32 ref: 00414115
              • __freefls@4.LIBCMT ref: 00414135
              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
              • String ID:
              • API String ID: 1925773019-0
              • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
              • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
              • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
              • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
              APIs
              • VariantClear.OLEAUT32(00000038), ref: 004357C3
              • VariantClear.OLEAUT32(00000058), ref: 004357C9
              • VariantClear.OLEAUT32(00000068), ref: 004357CF
              • VariantClear.OLEAUT32(00000078), ref: 004357D5
              • VariantClear.OLEAUT32(00000088), ref: 004357DE
              • VariantClear.OLEAUT32(00000048), ref: 004357E4
              • VariantClear.OLEAUT32(00000098), ref: 004357ED
              • VariantClear.OLEAUT32(000000A8), ref: 004357F6
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClearVariant
              • String ID:
              • API String ID: 1473721057-0
              • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
              • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
              • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
              • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
              APIs
              • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
              • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
              • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
              • _memset.LIBCMT ref: 00464B92
              • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
              • GlobalFree.KERNEL32(00000000), ref: 00464CDE
              • WSACleanup.WSOCK32 ref: 00464CE4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
              • String ID:
              • API String ID: 3424476444-0
              • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
              • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
              • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
              • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
              APIs
              • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MetricsSystem
              • String ID:
              • API String ID: 4116985748-0
              • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
              • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
              • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
              • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ConnectRegistry_wcslen
              • String ID:
              • API String ID: 535477410-0
              • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
              • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
              • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
              • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
              APIs
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • _memset.LIBCMT ref: 004538C4
              • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
              • _wcslen.LIBCMT ref: 00453960
              • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
              • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
              • String ID: 0
              • API String ID: 3530711334-4108050209
              • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
              • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
              • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
              • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
              APIs
              • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
              • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$CloseCountersCurrentHandleOpen
              • String ID: HH
              • API String ID: 3488606520-2761332787
              • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
              • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
              • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
              • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
              APIs
                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
              • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
              • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
              • LineTo.GDI32(?,?), ref: 004474BF
              • CloseFigure.GDI32(?), ref: 004474C6
              • SetPixel.GDI32(?,?,?,?), ref: 004474D6
              • Rectangle.GDI32(?,?), ref: 004474F3
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
              • String ID:
              • API String ID: 4082120231-0
              • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
              • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
              • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
              • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
              APIs
                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
              • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
              • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
              • LineTo.GDI32(?,?), ref: 004474BF
              • CloseFigure.GDI32(?), ref: 004474C6
              • SetPixel.GDI32(?,?,?,?), ref: 004474D6
              • Rectangle.GDI32(?,?), ref: 004474F3
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
              • String ID:
              • API String ID: 4082120231-0
              • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
              • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
              • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
              • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
              • String ID:
              • API String ID: 288456094-0
              • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
              • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
              • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
              • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
              APIs
              • GetParent.USER32(?), ref: 004449B0
              • GetKeyboardState.USER32(?), ref: 004449C3
              • SetKeyboardState.USER32(?), ref: 00444A0F
              • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
              • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
              • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
              • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessagePost$KeyboardState$Parent
              • String ID:
              • API String ID: 87235514-0
              • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
              • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
              • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
              • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
              APIs
              • GetParent.USER32(?), ref: 00444BA9
              • GetKeyboardState.USER32(?), ref: 00444BBC
              • SetKeyboardState.USER32(?), ref: 00444C08
              • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
              • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
              • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
              • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessagePost$KeyboardState$Parent
              • String ID:
              • API String ID: 87235514-0
              • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
              • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
              • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
              • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
              • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
              • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
              • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ConnectRegistry_wcslen
              • String ID: HH
              • API String ID: 535477410-2761332787
              • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
              • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
              • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
              • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
              APIs
              • _memset.LIBCMT ref: 00457C34
              • _memset.LIBCMT ref: 00457CE8
              • ShellExecuteExW.SHELL32(?), ref: 00457D34
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • CloseHandle.KERNEL32(?), ref: 00457DDD
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
              • String ID: <$@
              • API String ID: 1325244542-1426351568
              • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
              • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
              • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
              • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
              APIs
              • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
              • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
              • __wsplitpath.LIBCMT ref: 004737E1
                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
              • _wcscat.LIBCMT ref: 004737F6
              • __wcsicoll.LIBCMT ref: 00473818
              • Process32NextW.KERNEL32(00000000,?), ref: 00473844
              • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
              • String ID:
              • API String ID: 2547909840-0
              • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
              • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
              • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
              • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
              APIs
              • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
              • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
              • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
              • String ID:
              • API String ID: 2354583917-0
              • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
              • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
              • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
              • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
              APIs
              • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
              • GetProcAddress.KERNEL32(?,?), ref: 00463E68
              • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
              • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
              • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressProc$Library$FreeLoad
              • String ID: Wu
              • API String ID: 2449869053-4083010176
              • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
              • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
              • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
              • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
              APIs
                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
              • GetMenu.USER32 ref: 004776AA
              • GetMenuItemCount.USER32(00000000), ref: 004776CC
              • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
              • _wcslen.LIBCMT ref: 0047771A
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$CountItemStringWindow_wcslen
              • String ID:
              • API String ID: 1823500076-0
              • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
              • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
              • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
              • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
              APIs
              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
              • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Enable$Show$MessageMoveSend
              • String ID:
              • API String ID: 896007046-0
              • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
              • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
              • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
              • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
              APIs
              • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
              • GetWindowLongW.USER32(?,000000F0), ref: 00441452
              • GetWindowLongW.USER32(?,000000F0), ref: 00441493
              • SendMessageW.USER32(02F71B98,000000F1,00000000,00000000), ref: 004414C6
              • SendMessageW.USER32(02F71B98,000000F1,00000001,00000000), ref: 004414F1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$LongWindow
              • String ID:
              • API String ID: 312131281-0
              • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
              • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
              • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
              • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
              APIs
              • _memset.LIBCMT ref: 004484C4
              • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
              • IsMenu.USER32(?), ref: 0044857B
              • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
              • DrawMenuBar.USER32 ref: 004485E4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$Item$DrawInfoInsert_memset
              • String ID: 0
              • API String ID: 3866635326-4108050209
              • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
              • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
              • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
              • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
              APIs
              • InterlockedIncrement.KERNEL32 ref: 0047247C
              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
              • Sleep.KERNEL32(0000000A), ref: 00472499
              • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
              • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Interlocked$DecrementIncrement$Sleep
              • String ID: 0vH
              • API String ID: 327565842-3662162768
              • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
              • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
              • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
              • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
              APIs
              • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
              • GetFocus.USER32 ref: 00448B1C
              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Enable$Show$FocusMessageSend
              • String ID:
              • API String ID: 3429747543-0
              • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
              • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
              • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
              • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
              APIs
              • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
              • __swprintf.LIBCMT ref: 0045D3CC
              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorMode$InformationVolume__swprintf
              • String ID: %lu$HH
              • API String ID: 3164766367-3924996404
              • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
              • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
              • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
              • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
              APIs
              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
              • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
              • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend
              • String ID: Msctls_Progress32
              • API String ID: 3850602802-3636473452
              • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
              • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
              • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
              • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
              APIs
              • ImageList_Destroy.COMCTL32(?), ref: 00455451
              • ImageList_Destroy.COMCTL32(?), ref: 0045545F
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
              • String ID:
              • API String ID: 3985565216-0
              • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
              • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
              • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
              • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
              APIs
              • ___set_flsgetvalue.LIBCMT ref: 00415737
              • __calloc_crt.LIBCMT ref: 00415743
              • __getptd.LIBCMT ref: 00415750
              • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
              • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
              • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
              • __dosmaperr.LIBCMT ref: 004157A9
                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
              • String ID:
              • API String ID: 1269668773-0
              • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
              • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
              • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
              • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
              APIs
                • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
              • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
              • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
              • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
              • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
              • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
              • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
              • String ID:
              • API String ID: 1957940570-0
              • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
              • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
              • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
              • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
              APIs
              • ___set_flsgetvalue.LIBCMT ref: 00415690
                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
              • ___fls_getvalue@4.LIBCMT ref: 0041569B
                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
              • ___fls_setvalue@8.LIBCMT ref: 004156AD
                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
              • ExitThread.KERNEL32 ref: 004156BD
              • __freefls@4.LIBCMT ref: 004156D9
              • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
              • String ID:
              • API String ID: 4166825349-0
              • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
              • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
              • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
              • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
              APIs
              • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
              • API String ID: 2574300362-3261711971
              • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
              • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
              • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
              • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
              • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
              • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
              • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
              APIs
              • GetClientRect.USER32(?,?), ref: 00433724
              • GetWindowRect.USER32(00000000,?), ref: 00433757
              • GetClientRect.USER32(0000001D,?), ref: 004337AC
              • GetSystemMetrics.USER32(0000000F), ref: 00433800
              • GetWindowRect.USER32(?,?), ref: 00433814
              • ScreenToClient.USER32(?,?), ref: 00433842
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Rect$Client$Window$MetricsScreenSystem
              • String ID:
              • API String ID: 3220332590-0
              • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
              • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
              • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
              • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _malloc_wcslen$_strcat_wcscpy
              • String ID:
              • API String ID: 1612042205-0
              • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
              • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
              • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
              • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
              APIs
              • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
              • SetKeyboardState.USER32(00000080), ref: 0044C59B
              • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
              • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
              • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
              • SendInput.USER32 ref: 0044C6E2
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessagePost$KeyboardState$InputSend
              • String ID:
              • API String ID: 2221674350-0
              • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
              • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
              • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
              • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcscpy$_wcscat
              • String ID:
              • API String ID: 2037614760-0
              • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
              • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
              • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
              • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
              APIs
              • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
              • GetWindowRect.USER32(?,?), ref: 00447C1B
              • ScreenToClient.USER32(?,?), ref: 00447C39
              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
              • EndPaint.USER32(?,?), ref: 00447CD1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
              • String ID:
              • API String ID: 4189319755-0
              • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
              • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
              • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
              • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
              APIs
              • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
              • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
              • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
              • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
              • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID:
              • API String ID: 1726766782-0
              • Opcode ID: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
              • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
              • Opcode Fuzzy Hash: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
              • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
              APIs
              • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
              • EnableWindow.USER32(?,00000000), ref: 0044111A
              • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
              • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
              • EnableWindow.USER32(?,00000001), ref: 004411B3
              • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Show$Enable$MessageSend
              • String ID:
              • API String ID: 642888154-0
              • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
              • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
              • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
              • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
              APIs
              • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
              • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
              • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
              • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
              • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$LongWindow$InvalidateRect
              • String ID:
              • API String ID: 1976402638-0
              • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
              • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
              • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
              • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
              APIs
              • GetForegroundWindow.USER32 ref: 00442597
                • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
              • GetDesktopWindow.USER32 ref: 004425BF
              • GetWindowRect.USER32(00000000), ref: 004425C6
              • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
              • GetCursorPos.USER32(?), ref: 00442624
              • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
              • String ID:
              • API String ID: 4137160315-0
              • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
              • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
              • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
              • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
              APIs
              • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Enable$Show$MessageSend
              • String ID:
              • API String ID: 1871949834-0
              • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
              • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
              • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
              • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
              APIs
              • _memset.LIBCMT ref: 0044961A
              • SendMessageW.USER32 ref: 0044964A
                • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
              • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
              • _wcslen.LIBCMT ref: 004496BA
              • _wcslen.LIBCMT ref: 004496C7
              • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$_wcslen$_memset_wcspbrk
              • String ID:
              • API String ID: 1624073603-0
              • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
              • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
              • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
              • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
              • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
              • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
              • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
              APIs
              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DestroyWindow$DeleteObject$IconMove
              • String ID:
              • API String ID: 1640429340-0
              • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
              • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
              • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
              • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteMenuObject$IconWindow
              • String ID:
              • API String ID: 752480666-0
              • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
              • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
              • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
              • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
              APIs
              • DestroyWindow.USER32(00000000), ref: 0045527A
              • ImageList_Destroy.COMCTL32(?), ref: 0045528C
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteObjectWindow$IconImageList_
              • String ID:
              • API String ID: 3275902921-0
              • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
              • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
              • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
              • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
              APIs
              • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
              • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
              • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
              • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
              • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
              • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
              • String ID:
              • API String ID: 1413079979-0
              • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
              • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
              • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
              • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
              APIs
              • ___set_flsgetvalue.LIBCMT ref: 0041418F
              • __calloc_crt.LIBCMT ref: 0041419B
              • __getptd.LIBCMT ref: 004141A8
              • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
              • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
              • __dosmaperr.LIBCMT ref: 00414201
                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
              • String ID:
              • API String ID: 1803633139-0
              • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
              • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
              • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
              • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
              APIs
              • ImageList_Destroy.COMCTL32(?), ref: 004555E8
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteObjectWindow$IconImageList_
              • String ID:
              • API String ID: 3275902921-0
              • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
              • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
              • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
              • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
              APIs
              • SendMessageW.USER32 ref: 004554DF
              • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DeleteDestroyMessageObjectSend$IconWindow
              • String ID:
              • API String ID: 3691411573-0
              • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
              • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
              • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
              • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$_wcstok$ExtentPoint32Text
              • String ID:
              • API String ID: 1814673581-0
              • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
              • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
              • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
              • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
              APIs
              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
              • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: PerformanceQuery$CounterSleep$Frequency
              • String ID:
              • API String ID: 2833360925-0
              • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
              • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
              • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
              • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
              APIs
                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
              • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
              • LineTo.GDI32(?,?,?), ref: 00447227
              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
              • LineTo.GDI32(?,?,?), ref: 0044723D
              • EndPath.GDI32(?), ref: 0044724E
              • StrokePath.GDI32(?), ref: 0044725C
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
              • String ID:
              • API String ID: 372113273-0
              • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
              • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
              • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
              • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
              APIs
              • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
              • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
              • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
              • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
              • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
              • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Virtual
              • String ID:
              • API String ID: 4278518827-0
              • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
              • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
              • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
              • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
              APIs
              • GetDC.USER32(00000000), ref: 0044CBEF
              • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
              • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
              • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
              • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CapsDevice$Release
              • String ID:
              • API String ID: 1035833867-0
              • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
              • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
              • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
              • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
              APIs
              • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
              • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
              • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
              • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
              • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
              • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
              • String ID:
              • API String ID: 3495660284-0
              • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
              • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
              • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
              • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
              APIs
              • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
              • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
              • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
              • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
              • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
              • CloseHandle.KERNEL32(00000000), ref: 00437174
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
              • String ID:
              • API String ID: 839392675-0
              • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
              • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
              • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
              • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
              APIs
              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\Payment confirmaton copy.exe,00000004), ref: 00436055
              • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
              • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
              • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
              • GetLastError.KERNEL32 ref: 00436081
              • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
              • String ID:
              • API String ID: 1690418490-0
              • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
              • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
              • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
              • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
              APIs
                • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
              • CoInitialize.OLE32(00000000), ref: 00475B71
              • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
              • CoUninitialize.OLE32 ref: 00475D71
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateInitializeInstanceUninitialize_wcslen
              • String ID: .lnk$HH
              • API String ID: 886957087-3121654589
              • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
              • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
              • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
              • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$Delete$InfoItem_memset
              • String ID: 0
              • API String ID: 1173514356-4108050209
              • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
              • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
              • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
              • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
              APIs
              • LoadLibraryA.KERNEL32(?), ref: 00437CB2
              • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
              • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Library$AddressFreeLoadProc
              • String ID: AU3_GetPluginDetails$Wu
              • API String ID: 145871493-136108093
              • Opcode ID: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
              • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
              • Opcode Fuzzy Hash: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
              • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
              • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
              • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 763830540-1403004172
              • Opcode ID: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
              • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
              • Opcode Fuzzy Hash: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
              • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
              APIs
              • GetStdHandle.KERNEL32(?), ref: 004439B4
                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75572EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CurrentHandleProcess$Duplicate
              • String ID: nul
              • API String ID: 2124370227-2873401336
              • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
              • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
              • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
              • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
              APIs
              • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75572EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CurrentHandleProcess$Duplicate
              • String ID: nul
              • API String ID: 2124370227-2873401336
              • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
              • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
              • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
              • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
              APIs
              • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
              • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
              • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
              • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$DestroyLibraryLoadWindow
              • String ID: SysAnimate32
              • API String ID: 3529120543-1011021900
              • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
              • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
              • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
              • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
              APIs
              • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
              • TranslateMessage.USER32(?), ref: 0044308B
              • DispatchMessageW.USER32(?), ref: 00443096
              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Message$Peek$DispatchTranslate
              • String ID: *.*
              • API String ID: 1795658109-438819550
              • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
              • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
              • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
              • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
              APIs
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
              • GetFocus.USER32 ref: 004609EF
                • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
              • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
              • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
              • __swprintf.LIBCMT ref: 00460A7A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
              • String ID: %s%d
              • API String ID: 991886796-1110647743
              • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
              • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
              • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
              • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _memset$_sprintf
              • String ID: %02X
              • API String ID: 891462717-436463671
              • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
              • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
              • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
              • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
              APIs
              • _memset.LIBCMT ref: 0042CD00
              • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Payment confirmaton copy.exe,?,C:\Users\user\Desktop\Payment confirmaton copy.exe,004A8E80,C:\Users\user\Desktop\Payment confirmaton copy.exe,0040F3D2), ref: 0040FFCA
                • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
              • String ID: $OH$@OH$X
              • API String ID: 3491138722-1394974532
              • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
              • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
              • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
              • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
              APIs
              • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
              • SetKeyboardState.USER32(00000080), ref: 0044C3ED
              • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
              • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
              • SendInput.USER32 ref: 0044C509
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: KeyboardMessagePostState$InputSend
              • String ID:
              • API String ID: 3031425849-0
              • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
              • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
              • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
              • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
              APIs
              • RegEnumKeyExW.ADVAPI32 ref: 004422F0
              • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
              • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
              • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
              • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Enum$CloseDeleteOpen
              • String ID:
              • API String ID: 2095303065-0
              • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
              • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
              • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
              • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
              APIs
              • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
              • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
              • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
              • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: PrivateProfile$SectionWrite$String
              • String ID:
              • API String ID: 2832842796-0
              • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
              • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
              • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
              • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
              APIs
              • GetClientRect.USER32(?,?), ref: 00447997
              • GetCursorPos.USER32(?), ref: 004479A2
              • ScreenToClient.USER32(?,?), ref: 004479BE
              • WindowFromPoint.USER32(?,?), ref: 004479FF
              • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Client$CursorFromPointProcRectScreenWindow
              • String ID:
              • API String ID: 1822080540-0
              • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
              • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
              • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
              • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
              APIs
              • GetWindowRect.USER32(?,?), ref: 00447C1B
              • ScreenToClient.USER32(?,?), ref: 00447C39
              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
              • EndPaint.USER32(?,?), ref: 00447CD1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClientPaintRectRectangleScreenViewportWindow
              • String ID:
              • API String ID: 659298297-0
              • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
              • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
              • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
              • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
              APIs
              • GetCursorPos.USER32(?), ref: 004478A7
              • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
              • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
              • GetCursorPos.USER32(?), ref: 00447935
              • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CursorMenuPopupTrack$Proc
              • String ID:
              • API String ID: 1300944170-0
              • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
              • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
              • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
              • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
              APIs
              • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
              • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
              • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
              • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                • Part of subcall function 004413F0: SendMessageW.USER32(02F71B98,000000F1,00000000,00000000), ref: 004414C6
                • Part of subcall function 004413F0: SendMessageW.USER32(02F71B98,000000F1,00000001,00000000), ref: 004414F1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$EnableMessageSend$LongShow
              • String ID:
              • API String ID: 142311417-0
              • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
              • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
              • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
              • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
              APIs
              • _memset.LIBCMT ref: 0044955A
                • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
              • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
              • _wcslen.LIBCMT ref: 004495C1
              • _wcslen.LIBCMT ref: 004495CE
              • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend_wcslen$_memset_wcspbrk
              • String ID:
              • API String ID: 1843234404-0
              • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
              • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
              • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
              • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
              • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
              • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
              • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
              APIs
              • IsWindowVisible.USER32(?), ref: 00445721
              • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
              • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
              • _wcslen.LIBCMT ref: 004457A3
              • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
              • String ID:
              • API String ID: 3087257052-0
              • Opcode ID: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
              • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
              • Opcode Fuzzy Hash: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
              • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
              APIs
              • IsWindow.USER32(00000000), ref: 00459DEF
              • GetForegroundWindow.USER32 ref: 00459E07
              • GetDC.USER32(00000000), ref: 00459E44
              • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
              • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$ForegroundPixelRelease
              • String ID:
              • API String ID: 4156661090-0
              • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
              • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
              • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
              • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
              APIs
                • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
              • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
              • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
              • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
              • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
              • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLast$closesocketconnectinet_addrsocket
              • String ID:
              • API String ID: 245547762-0
              • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
              • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
              • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
              • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
              APIs
              • DeleteObject.GDI32(00000000), ref: 00447151
              • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
              • SelectObject.GDI32(?,00000000), ref: 004471A2
              • BeginPath.GDI32(?), ref: 004471B7
              • SelectObject.GDI32(?,00000000), ref: 004471DC
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Object$Select$BeginCreateDeletePath
              • String ID:
              • API String ID: 2338827641-0
              • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
              • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
              • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
              • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
              APIs
              • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
              • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
              • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CounterPerformanceQuerySleep
              • String ID:
              • API String ID: 2875609808-0
              • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
              • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
              • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
              • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
              APIs
              • SendMessageW.USER32 ref: 0046FD00
              • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
              • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
              • DestroyIcon.USER32(?), ref: 0046FD58
              • DestroyIcon.USER32(?), ref: 0046FD5F
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$DestroyIcon
              • String ID:
              • API String ID: 3419509030-0
              • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
              • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
              • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
              • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
              APIs
              • __getptd.LIBCMT ref: 004175AE
                • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
              • __amsg_exit.LIBCMT ref: 004175CE
              • __lock.LIBCMT ref: 004175DE
              • InterlockedDecrement.KERNEL32(?), ref: 004175FB
              • InterlockedIncrement.KERNEL32(02F72D20), ref: 00417626
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
              • String ID:
              • API String ID: 4271482742-0
              • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
              • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
              • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
              • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
              APIs
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteObjectWindow$Icon
              • String ID:
              • API String ID: 4023252218-0
              • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
              • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
              • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
              • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
              APIs
              • GetDlgItem.USER32(?,000003E9), ref: 00460342
              • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
              • MessageBeep.USER32(00000000), ref: 0046036D
              • KillTimer.USER32(?,0000040A), ref: 00460392
              • EndDialog.USER32(?,00000001), ref: 004603AB
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BeepDialogItemKillMessageTextTimerWindow
              • String ID:
              • API String ID: 3741023627-0
              • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
              • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
              • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
              • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
              APIs
              • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DeleteDestroyObject$IconMessageSendWindow
              • String ID:
              • API String ID: 1489400265-0
              • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
              • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
              • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
              • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
              APIs
                • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
              • String ID:
              • API String ID: 1042038666-0
              • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
              • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
              • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
              • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Path$ObjectStroke$DeleteFillSelect
              • String ID:
              • API String ID: 2625713937-0
              • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
              • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
              • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
              • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
              APIs
                • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
              • ___set_flsgetvalue.LIBCMT ref: 004140E1
                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
              • ___fls_getvalue@4.LIBCMT ref: 004140EC
                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
              • ___fls_setvalue@8.LIBCMT ref: 004140FF
                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
              • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
              • ExitThread.KERNEL32 ref: 0041410F
              • GetCurrentThreadId.KERNEL32 ref: 00414115
              • __freefls@4.LIBCMT ref: 00414135
              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
              • String ID:
              • API String ID: 132634196-0
              • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
              • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
              • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
              • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
              APIs
              • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
              • __getptd_noexit.LIBCMT ref: 00415620
              • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
              • __freeptd.LIBCMT ref: 0041563B
              • ExitThread.KERNEL32 ref: 00415643
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
              • String ID:
              • API String ID: 3798957060-0
              • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
              • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
              • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
              • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
              APIs
                • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
              • ___set_flsgetvalue.LIBCMT ref: 00415690
                • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
              • ___fls_getvalue@4.LIBCMT ref: 0041569B
                • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
              • ___fls_setvalue@8.LIBCMT ref: 004156AD
                • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
              • ExitThread.KERNEL32 ref: 004156BD
              • __freefls@4.LIBCMT ref: 004156D9
              • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
              • String ID:
              • API String ID: 1537469427-0
              • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
              • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
              • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
              • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _malloc
              • String ID: Default$|k
              • API String ID: 1579825452-2254895183
              • Opcode ID: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
              • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
              • Opcode Fuzzy Hash: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
              • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _memcmp
              • String ID: '$[$h
              • API String ID: 2931989736-1224472061
              • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
              • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
              • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
              • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _strncmp
              • String ID: >$R$U
              • API String ID: 909875538-1924298640
              • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
              • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
              • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
              • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
              APIs
                • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
              • CoInitialize.OLE32(00000000), ref: 0046CE18
              • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
              • CoUninitialize.OLE32 ref: 0046CE50
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateInitializeInstanceUninitialize_wcslen
              • String ID: .lnk
              • API String ID: 886957087-24824748
              • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
              • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
              • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
              • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
              Strings
              • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen
              • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
              • API String ID: 176396367-557222456
              • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
              • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
              • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
              • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
              APIs
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
              • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
              • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Variant$ClearCopyInit_malloc
              • String ID: 4RH
              • API String ID: 2981388473-749298218
              • Opcode ID: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
              • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
              • Opcode Fuzzy Hash: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
              • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
              APIs
                • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
              • __wcsnicmp.LIBCMT ref: 0046681A
              • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Connection__wcsnicmp_wcscpy_wcslen
              • String ID: LPT$HH
              • API String ID: 3035604524-2728063697
              • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
              • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
              • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
              • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
              APIs
                • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
              • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
              • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$MemoryProcess$ReadWrite
              • String ID: @
              • API String ID: 4055202900-2766056989
              • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
              • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
              • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
              • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CrackInternet_memset_wcslen
              • String ID: |
              • API String ID: 915713708-2343686810
              • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
              • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
              • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
              • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
              APIs
              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
              • HttpQueryInfoW.WININET ref: 0044A892
                • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
              • String ID:
              • API String ID: 3705125965-3916222277
              • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
              • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
              • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
              • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
              APIs
              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
              • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Long
              • String ID: SysTreeView32
              • API String ID: 847901565-1698111956
              • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
              • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
              • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
              • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
              APIs
              • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DestroyWindow
              • String ID: msctls_updown32
              • API String ID: 3375834691-2298589950
              • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
              • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
              • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
              • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
              APIs
              • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
              • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
              • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$MoveWindow
              • String ID: Listbox
              • API String ID: 3315199576-2633736733
              • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
              • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
              • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
              • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
              APIs
              • SetErrorMode.KERNEL32(00000001), ref: 0045D243
              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorMode$InformationVolume
              • String ID: HH
              • API String ID: 2507767853-2761332787
              • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
              • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
              • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
              • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
              APIs
              • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorMode$InformationVolume
              • String ID: HH
              • API String ID: 2507767853-2761332787
              • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
              • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
              • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
              • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
              APIs
              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
              • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend
              • String ID: msctls_trackbar32
              • API String ID: 3850602802-1010561917
              • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
              • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
              • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
              • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
              APIs
                • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
              • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
              • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
              • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
              • String ID: HH
              • API String ID: 1515696956-2761332787
              • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
              • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
              • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
              • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
              APIs
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • GetMenuItemInfoW.USER32 ref: 004497EA
              • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
              • DrawMenuBar.USER32 ref: 00449828
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Menu$InfoItem$Draw_malloc
              • String ID: 0
              • API String ID: 772068139-4108050209
              • Opcode ID: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
              • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
              • Opcode Fuzzy Hash: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
              • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AllocTask_wcslen
              • String ID: hkG
              • API String ID: 2651040394-3610518997
              • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
              • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
              • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
              • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
              APIs
              • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
              • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: GetSystemWow64DirectoryW$kernel32.dll
              • API String ID: 2574300362-1816364905
              • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
              • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
              • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
              • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
              APIs
              • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
              • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: ICMP.DLL$IcmpSendEcho
              • API String ID: 2574300362-58917771
              • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
              • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
              • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
              • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
              APIs
              • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
              • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: ICMP.DLL$IcmpCloseHandle
              • API String ID: 2574300362-3530519716
              • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
              • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
              • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
              • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
              APIs
              • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
              • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: AddressLibraryLoadProc
              • String ID: ICMP.DLL$IcmpCreateFile
              • API String ID: 2574300362-275556492
              • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
              • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
              • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
              • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClearVariant
              • String ID:
              • API String ID: 1473721057-0
              • Opcode ID: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
              • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
              • Opcode Fuzzy Hash: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
              • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
              APIs
              • __flush.LIBCMT ref: 00414630
              • __fileno.LIBCMT ref: 00414650
              • __locking.LIBCMT ref: 00414657
              • __flsbuf.LIBCMT ref: 00414682
                • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
              • String ID:
              • API String ID: 3240763771-0
              • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
              • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
              • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
              • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
              APIs
              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
              • VariantCopy.OLEAUT32(?,?), ref: 00478259
              • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
              • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CopyVariant$ErrorLast
              • String ID:
              • API String ID: 2286883814-0
              • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
              • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
              • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
              • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
              APIs
              • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
              • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
              • #21.WSOCK32 ref: 004740E0
              • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLast$socket
              • String ID:
              • API String ID: 1881357543-0
              • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
              • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
              • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
              • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
              APIs
              • ClientToScreen.USER32(00000000,?), ref: 00441CDE
              • GetWindowRect.USER32(?,?), ref: 00441D5A
              • PtInRect.USER32(?,?,?), ref: 00441D6F
              • MessageBeep.USER32(00000000), ref: 00441DF2
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Rect$BeepClientMessageScreenWindow
              • String ID:
              • API String ID: 1352109105-0
              • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
              • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
              • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
              • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
              APIs
              • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
              • __isleadbyte_l.LIBCMT ref: 004238B2
              • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
              • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
              • String ID:
              • API String ID: 3058430110-0
              • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
              • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
              • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
              • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
              APIs
              • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
              • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
              • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
              • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CreateHardLink$DeleteErrorFileLast
              • String ID:
              • API String ID: 3321077145-0
              • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
              • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
              • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
              • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
              APIs
              • GetParent.USER32(?), ref: 004505BF
              • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
              • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
              • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Proc$Parent
              • String ID:
              • API String ID: 2351499541-0
              • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
              • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
              • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
              • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
              APIs
                • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
              • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
              • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
              • __itow.LIBCMT ref: 00461461
              • __itow.LIBCMT ref: 004614AB
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$__itow$_wcslen
              • String ID:
              • API String ID: 2875217250-0
              • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
              • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
              • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
              • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
              APIs
              • GetForegroundWindow.USER32 ref: 00472806
                • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
              • GetCaretPos.USER32(?), ref: 0047281A
              • ClientToScreen.USER32(00000000,?), ref: 00472856
              • GetForegroundWindow.USER32 ref: 0047285C
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
              • String ID:
              • API String ID: 2759813231-0
              • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
              • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
              • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
              • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
              APIs
                • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
              • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
              • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
              • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
              • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$Long$AttributesLayered
              • String ID:
              • API String ID: 2169480361-0
              • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
              • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
              • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
              • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
              APIs
              • SendMessageW.USER32 ref: 00448CB8
              • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
              • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
              • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend$LongWindow
              • String ID:
              • API String ID: 312131281-0
              • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
              • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
              • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
              • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
              APIs
              • select.WSOCK32 ref: 0045890A
              • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
              • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
              • WSAGetLastError.WSOCK32(00000000), ref: 00458952
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ErrorLastacceptselect
              • String ID:
              • API String ID: 385091864-0
              • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
              • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
              • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
              • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
              APIs
              • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend
              • String ID:
              • API String ID: 3850602802-0
              • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
              • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
              • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
              • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
              APIs
              • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
              • GetStockObject.GDI32(00000011), ref: 00433695
              • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
              • ShowWindow.USER32(00000000,00000000), ref: 004336BA
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Window$CreateMessageObjectSendShowStock
              • String ID:
              • API String ID: 1358664141-0
              • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
              • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
              • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
              • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
              APIs
              • GetCurrentThreadId.KERNEL32 ref: 004441B8
              • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
              • CloseHandle.KERNEL32(00000000), ref: 00444213
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
              • String ID:
              • API String ID: 2880819207-0
              • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
              • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
              • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
              • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
              APIs
              • GetWindowRect.USER32(?,?), ref: 00434037
              • ScreenToClient.USER32(?,?), ref: 0043405B
              • ScreenToClient.USER32(?,?), ref: 00434085
              • InvalidateRect.USER32(?,?,?), ref: 004340A4
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ClientRectScreen$InvalidateWindow
              • String ID:
              • API String ID: 357397906-0
              • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
              • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
              • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
              • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
              APIs
              • __wsplitpath.LIBCMT ref: 00436A45
                • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
              • __wsplitpath.LIBCMT ref: 00436A6C
              • __wcsicoll.LIBCMT ref: 00436A93
              • __wcsicoll.LIBCMT ref: 00436AB0
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
              • String ID:
              • API String ID: 1187119602-0
              • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
              • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
              • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
              • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _wcslen$_malloc_wcscat_wcscpy
              • String ID:
              • API String ID: 1597257046-0
              • Opcode ID: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
              • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
              • Opcode Fuzzy Hash: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
              • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
              APIs
              • DeleteObject.GDI32(?), ref: 0045564E
              • DeleteObject.GDI32(?), ref: 0045565C
              • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
              • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: DeleteDestroyObject$IconWindow
              • String ID:
              • API String ID: 3349847261-0
              • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
              • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
              • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
              • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
              APIs
              • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
              • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
              • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
              • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CriticalSection$Leave$EnterExchangeInterlocked
              • String ID:
              • API String ID: 2223660684-0
              • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
              • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
              • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
              • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
              APIs
                • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
              • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
              • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
              • EndPath.GDI32(?), ref: 004472B0
              • StrokePath.GDI32(?), ref: 004472BE
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
              • String ID:
              • API String ID: 2783949968-0
              • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
              • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
              • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
              • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
              APIs
              • __getptd.LIBCMT ref: 00417D1A
                • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
              • __getptd.LIBCMT ref: 00417D31
              • __amsg_exit.LIBCMT ref: 00417D3F
              • __lock.LIBCMT ref: 00417D4F
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: __amsg_exit__getptd$__getptd_noexit__lock
              • String ID:
              • API String ID: 3521780317-0
              • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
              • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
              • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
              • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
              APIs
              • GetDesktopWindow.USER32 ref: 00471144
              • GetDC.USER32(00000000), ref: 0047114D
              • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
              • ReleaseDC.USER32(00000000,?), ref: 0047117B
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CapsDesktopDeviceReleaseWindow
              • String ID:
              • API String ID: 2889604237-0
              • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
              • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
              • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
              • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
              APIs
              • GetDesktopWindow.USER32 ref: 00471102
              • GetDC.USER32(00000000), ref: 0047110B
              • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
              • ReleaseDC.USER32(00000000,?), ref: 00471139
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CapsDesktopDeviceReleaseWindow
              • String ID:
              • API String ID: 2889604237-0
              • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
              • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
              • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
              • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
              APIs
              • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
              • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
              • GetCurrentThreadId.KERNEL32 ref: 004389DA
              • AttachThreadInput.USER32(00000000), ref: 004389E1
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
              • String ID:
              • API String ID: 2710830443-0
              • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
              • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
              • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
              • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
              APIs
              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
              • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
              • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
              • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
              • String ID:
              • API String ID: 146765662-0
              • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
              • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
              • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
              • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
              APIs
              • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
              • __getptd_noexit.LIBCMT ref: 00414080
              • __freeptd.LIBCMT ref: 0041408A
              • ExitThread.KERNEL32 ref: 00414093
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
              • String ID:
              • API String ID: 3182216644-0
              • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
              • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
              • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
              • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BuffCharLower
              • String ID: $8'I
              • API String ID: 2358735015-3608026889
              • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
              • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
              • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
              • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
              APIs
              • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
              • String ID: AutoIt3GUI$Container
              • API String ID: 3380330463-3941886329
              • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
              • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
              • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
              • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
              APIs
              • _wcslen.LIBCMT ref: 00409A61
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
              • CharUpperBuffW.USER32(?,?), ref: 00409AF5
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
              • String ID: 0vH
              • API String ID: 1143807570-3662162768
              • Opcode ID: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
              • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
              • Opcode Fuzzy Hash: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
              • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: HH$HH
              • API String ID: 0-1787419579
              • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
              • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
              • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
              • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: InfoItemMenu_memset
              • String ID: 0
              • API String ID: 2223754486-4108050209
              • Opcode ID: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
              • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
              • Opcode Fuzzy Hash: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
              • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
              APIs
              • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend
              • String ID: '
              • API String ID: 3850602802-1997036262
              • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
              • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
              • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
              • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID:
              • String ID: 0
              • API String ID: 0-4108050209
              • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
              • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
              • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
              • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
              APIs
              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
              • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend
              • String ID: Combobox
              • API String ID: 3850602802-2096851135
              • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
              • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
              • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
              • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
              APIs
              • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
              • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: LengthMessageSendTextWindow
              • String ID: edit
              • API String ID: 2978978980-2167791130
              • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
              • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
              • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
              • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
              APIs
              • Sleep.KERNEL32(00000000), ref: 00474833
              • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: GlobalMemorySleepStatus
              • String ID: @
              • API String ID: 2783356886-2766056989
              • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
              • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
              • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
              • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: htonsinet_addr
              • String ID: 255.255.255.255
              • API String ID: 3832099526-2422070025
              • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
              • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
              • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
              • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 455545452-1403004172
              • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
              • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
              • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
              • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
              APIs
              • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: InternetOpen
              • String ID: <local>
              • API String ID: 2038078732-4266983199
              • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
              • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
              • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
              • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 455545452-1403004172
              • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
              • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
              • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
              • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
              APIs
                • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
              • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend_wcslen
              • String ID: ComboBox$ListBox
              • API String ID: 455545452-1403004172
              • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
              • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
              • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
              • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _strncmp
              • String ID: ,$UTF8)
              • API String ID: 909875538-2632631837
              • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
              • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
              • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
              • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: _strncmp
              • String ID: ,$UTF8)
              • API String ID: 909875538-2632631837
              • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
              • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
              • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
              • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
              APIs
              • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
              • wsprintfW.USER32 ref: 004560E9
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: MessageSend_mallocwsprintf
              • String ID: %d/%02d/%02d
              • API String ID: 1262938277-328681919
              • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
              • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
              • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
              • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
              APIs
              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FindMessagePostSleepWindow
              • String ID: Shell_TrayWnd
              • API String ID: 529655941-2988720461
              • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
              • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
              • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
              • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
              APIs
              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
              • PostMessageW.USER32(00000000), ref: 00442247
                • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: FindMessagePostSleepWindow
              • String ID: Shell_TrayWnd
              • API String ID: 529655941-2988720461
              • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
              • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
              • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
              • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
              APIs
              • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1625740596.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1625723240.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625779735.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625801432.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
              • Associated: 00000000.00000002.1625836243.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_400000_Payment confirmaton copy.jbxd
              Similarity
              • API ID: Message_doexit
              • String ID: AutoIt$Error allocating memory.
              • API String ID: 1993061046-4017498283
              • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
              • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
              • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
              • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E