24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 154:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious — Falcon Sandbox Report 5f0aad4d2e25… — Score 80/100 — Sample a18fa7d736da…","description":"Suspicious verdict for sandbox report 5f0aad4d2e25…. Threat score 80/100. 2 malicious and 6 suspicious behavioral indicators across 22 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/a18fa7d736daad7e5453a3ee6f96dd3d73677d46854fc59f467f10c6ae799df8/5f0aad4d2e252b423f59de18","keywords":["Suspicious","sandbox report","malware analysis","MITRE ATT\u0026CK","a18fa7d736daad7e5453a3ee6f96dd3d73677d46854fc59f467f10c6ae799df8"],"about":{"@type":"SoftwareApplication","name":"1640.dmp","applicationCategory":"data","identifier":"a18fa7d736daad7e5453a3ee6f96dd3d73677d46854fc59f467f10c6ae799df8","additionalType":"Suspicious sample"},"threatScore":80,"sandboxEnvironment":"Windows 7 64 bit","behavioralIndicators":{"malicious":2,"suspicious":6,"totalSignatures":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC26:T870,"R6rN ?}x IP9 DO;&kP~F qO;> O:FFkG|H HFX&YF.X@x"!PF"FFP0 P0 6! a=<8: qFWINMM.dll0 oo`o9 ooo}oRooH#Fw?=wRSDS WPP@oAx9WMicrosoftWindowsCommon-Controls-6.0.2600.5512-comctl32.pdbr9 U9 uj@=w]9 U9 u=w]9 U9 (9 ES9 XV9 pW9 }+x9 @=w+9 =w9 & x=w& 0 Eu^S=w9 & 0 }t\jWV=w9 & u+jY}9 E0 ED)Fw& E$0 ]tMQj" ">>`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& >`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& >`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& >`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& >`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& >`@x?XE J> @?(g,>@ ?43-spF>@"?P`E5+*>@x$?=QQD> @-DT!?\3& #,@&=OW]{9 tq_fH/:53ag Jl8~'|Sz+KD yFxER!i }r~2 (?M-Z0 [`b4;.Io" Pattern match: "www.amegybank.com/*" Pattern match: "https://ajax.googleapis.com/ajax/libs/jqueryui/1.7.1/themes/smoothness/ui.all.css" Pattern match: "https://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js" Pattern match: "https://ajax.googleapis.com/ajax/libs/jqueryui/1.7.1/jquery-ui.min.js" Pattern match: "https://account.authorize.net/UI/themes/anet/images/authorizenet_logo.gif\/" Pattern match: "https://mfasa.chase.com/auth/fcc/login" Pattern match: "http://www.chase.com/" Pattern match: "https://www.chase.com/online/Home/images/chaseNewlogo.gif" Pattern match: "https://chaseonline.chase.com/images//spacer.gif" Pattern match: "https://chaseonline.chase.com/content/ecpweb/sso/image/lock2.gif" Pattern match: "http://www.chase.com//ccp/index.jsp?pg_name=ccpmapp/shared/assets/page/security_measures" Pattern match: "https://chaseonline.chase.com/gw/secure/ena" Pattern match: "onlinebanking.tdbank.com/*getAccts.asp*" Pattern match: "https://onlinebanking.tdbank.com/images/TDBankLogo.gif" Pattern match: "secure.accurint.com/app/bps/mai*RQ" Pattern match: "saf.bankofamerica.com/login/*.go2" Pattern match: "bankofamerica.com/myacounts/*{Rz" Pattern match: "https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" Pattern match: "https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js" Pattern match: "wellsoffice.wellsfargo.com/ceoportal/signon/*" Pattern match: "rbs.com/wps/portal/cb/applications*" Pattern match: "webcmpr.bancopopular.com/K1/*" Heuristic match: "R:2z> | >+*N9}F}G}I}J}K}N}O}W}a}d~D~D}ljJLjJLJJnjsNjsNJsch.Ch.CH.aaAaAAcsCsCSdzDzDZgy'Gy'GY'lyLLyLLYLnyuNyuNYuszSzSZty~Ty~TY~zsZsZSdzsDzsDZSch.Ch.CH.ch" Pattern match: "cmd.exe/FP_NO_HOST_CHECK=NO#HOMEDRIVE=C" Pattern match: "ER.S.og/0'LQ/!EB" Pattern match: "q.qEqRq.qS.qogq/q0q'LqQ/q!EqqBq" Pattern match: "PATHcmd.execommand.com/cCOMSPECcmd.execommand.com/cCOMSPEChww__GLOBAL_HEAP_SELECTED__MSVCRT_HEAP_SELECT*wdww$wwww.wbwwnww9w" Pattern match: "xX-cC.vV/bB0nN1mM" Pattern match: "explorer.exe/N,/SEPARATE,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{21EC2020-3AEA-1069-A2DD-08002B30309D}hH|hv|B|nusrmgr.cpl"2b:T87e,"WINWORD.EXE" wrote bytes "e933f0c400" to virtual address "0xFD821180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "ef94b6eb0458d601" to virtual address "0xECC371C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "0010dafcfe070000" to virtual address "0xFCDBFE18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010dafcfe070000" to virtual address "0xFCDBFB18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "ba255c140558d601" to virtual address "0xE998D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "4013dafcfe070000" to virtual address "0xFCDBFE10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010dafcfe070000" to virtual address "0xFCDBFE50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013dafcfe070000" to virtual address "0xFCDBFB10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010dafcfe070000" to virtual address "0xFCDBFB50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "2d86b6eb0458d601" to virtual address "0xF38CFA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "e933efc400cccc" to virtual address "0xFD821210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "4381b6eb0458d601" to virtual address "0xEAC32350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "4013dafcfe070000" to virtual address "0xFCDBFE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013dafcfe070000" to virtual address "0xFCDBFB48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFD9D1748" (part of module "WS2_32.DLL") "WINWORD.EXE" wrote bytes "48b81016f7f3fe070000ffe0" to virtual address "0xFCDA1000" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b86013f7f3fe070000ffe0" to virtual address "0xFCDA1340" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8e011f7f3fe070000ffe0" to virtual address "0xFD9A1000" (part of module "WS2_32.DLL") "WINWORD.EXE" wrote bytes "ce57e2eb0458d601" to virtual address "0x3F393258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e9abc0c400cc" to virtual address "0xFD824060" ("SysAllocStringByteLen@OLEAUT32.DLL")2c:T25f9,"*treasurypathways.com* *CorporateAccounts*" *weblink.websterbank.com*$ *secure7.onlineaccess1.com* *trz.tranzact.org* *onlineaccess1.com** *secureport.texascapitalbank.com*! */Authentication/zbf/k/* *ebc_ebc1961* *tdbank.com* *online.ovcb.com* *ebanking-services.com* *schwab.com* *billmelater.com* *chase.com* *bankofamerica.com* *pnc.com* *suntrust.com* *wellsfargo.com* *ibanking-services.com*$ *bankonline.umpquabank.com* *servlet/teller* *nsbank.com*& *securentry.calbanktrust.com* *securentry*# */Common/SignOn/Start.asp* *telepc.net*# *enterprise2.openbank.com* *BusinessAppsHome*! *global1.onlinebank.com* *webexpress* */sbuser/* *webcash* *firstbanks.com* *bxs.com* *businesslogin* *hbcash.exe* *otm.suntrust.com* */inets/* *corpACH* */IBWS/* */ibs.* */livewire/* */olbb/*2 *fnfgbusinessonline.enterprisebanker.com*' *lakecitybank.webcashmgmt.com* */inets/* *bob.sovereignbank.com* *CLKCCM* *directline4biz.com* *e-moneyger.com* *cashman*' *securentrycorp.amegybank.com* *netteller* *onlineserv/CM* *nubi* *ibs5.secure-banking* *ibs.secure-banking* *blilk* *svbconnect.com* *goldleaf* */webcm/* *www.amegybank.com/* */wires/* *bankbyweb* *internet-ebanking.com* *treasury.pncbank.com* *sso.uboc* *cashplus*& *towernet.capitalonebank.com*% *nationalcity.com/consultnc* *authmaster.nationalcity.com/tmgmt*$ *businessonline.tdbank.com*$ *treasurydirect.tdbank.com*. *express.53.com/express/logon.action* *access.usbank.com* *treasury.wamu.com* *.associatedbank.com** *cashproonline.bankofamerica.com* *cib.bankofthewest.com* *cmol.bbt.com/auth* *bmoharrisprivatebankingonline.com* *bnycash.bankofny.com*# *ifxmanager.bnymellon.com*% *businessmanager.com/signon*# *banking.calbanktrust.com*& *towernet.capitalonebank.com* */cmserver/* *.com/K1/* *pub/html*0 *businessaccess.citibank.citigroup.com*) *achieveaccess.citizensbank.com* *comerica.com*. *businessclassonline.compassbank.com* *cashanalyzer.com* *ebanking-services.com* */ebc_ebc1961/* */cashman/*" *express.53.com/express/* *cbs.firstcitizens.com*% *banking.firsttennessee.biz* *efirstbank.com*" *treas-mgt.frostbank.com*( *businessonline.huntington.com* *ibbpowerlink.com* *access.jpmorgan.com* *blilk.com*$ *businessportal.mibank.com*. *webbankingforbusiness.mandtbank.com* *mbachexpress.com*( *premierview.membersunited.org*, *cashmanager.mizuhoe-treasurer.com* *enternetbank.com* *ntrs.com* *northerntrust.com* */Common/SignOn/* */CLKCCM/* *bankofamerica.com* *onlineserv/CM* *treasury.pncbank.com*- *rbs.com/wps/portal/cb/applications* *sandyspringbank.com*# *ssl.selectpayment.com/mp* *svbconnect.com*) *onlinebanking.banksterling.com*$ *businessonline.tdbank.com*( *passport.texascapitalbank.com*$ *nashvillecitizensbank.com*! *singlepoint.usbank.com* *sso.unionbank.com*" *commercial.wachovia.com* *wcmfd/wcmpw* *phcp/servlet*# *webinfocus.mandtbank.com*% *wellsoffice.wellsfargo.com* *bmomutualfunds.com* */netbnx/*# *businessbanking.cibc.com* *access.rbsm.com/logon*' *bolb-west.associatedbank.com*' *bolb-east.associatedbank.com** *cashproonline.bankofamerica.com* *cib.bankofthewest.com* *cmol.bbt.com/auth*, *bmoharrisprivatebankingonline.com* *bnycash.bankofny.com*# *ifxmanager.bnymellon.com*% *businessmanager.com/signon*# *banking.calbanktrust.com*& *towernet.capitalonebank.com* */cmserver/* *.com/K1/* *pub/html*0 *businessaccess.citibank.citigroup.com*) *achieveaccess.citizensbank.com* *www8.comerica.com*. *businessclassonline.compassbank.com* *cashanalyzer.com* *ebanking-services.com* */ebc_ebc1961/* */cashman/* *express.53.com* *cbs.firstcitizens.com*% *banking.firsttennessee.biz* *efirstbank.com*" *treas-mgt.frostbank.com*( *businessonline.huntington.com* *ibbpowerlink.com* *access.jpmorgan.com* *blilk.com*$ *businessportal.mibank.com*. *webbankingforbusiness.mandtbank.com* *mbachexpress.com*( *premierview.membersunited.org*, *cashmanager.mizuhoe-treasurer.com* *enternetbank.com* *ntrs.com* *northerntrust.com* */Common/SignOn/* */CLKCCM/* *onlineserv/CM* *treasury.pncbank.com* *rbs.com/wps/portal/* *sandyspringbank.com*# *ssl.selectpayment.com/mp* *svbconnect.com*) *onlinebanking.banksterling.com*$ *businessonline.tdbank.com*( *passport.texascapitalbank.com*$ *nashvillecitizensbank.com* */Authentication/zbf/k*! *singlepoint.usbank.com* *sso.unionbank.com*" *commercial.wachovia.com* *wcmfd/wcmpw* *phcp/servlet*# *webinfocus.mandtbank.com*% *wellsoffice.wellsfargo.com* *bmomutualfunds.com* */netbnx/*# *businessbanking.cibc.com* *cibconline.cibc.com*) *royalbank.com/cgi-bin/rbaccess* *access.rbsm.com/logon*& *scotiaonline.scotiabank.com*' *scotiaconnect.scotiabank.com*$ *easywebcpo.td.com/waw/idp* *boveda.banamex.com.mx* *hsbc.com.mx* */IBWS/* *CorporateAccounts* *securentry* */ach/* */wire/* *corpACH* *treasurypathways.com* *mycorporate.org* *ecash.* *secure.fnbhutch.com* *cnbsec1.* *e-moneyger* *createWire* *createCorpWire*% *business.netbankerplus.com*! *secure.fundsxpress.com* *firstbanks.com/olb* */CASHplus/* *cashman* *.onlineaccess1.com* *Pres_WA_Wires* *onlinencr.com*$ *bankonline.umpquabank.com*! *globalink.leumiusa.com* *my.statestreet.com*' *site-secure.com/TekPortfolio* *inetbanker* *secure.ally.com* *unitedbankwi.com* *hbproxy.exe* */inets/* *otm.suntrust.com* *cmserver* *svbconnect*! *secure.fsbperkasie.com* *scottvalleybank.com* *hillsbank.com* *vpn1.* */olbb/* *cu.com* *cu.org* *paylinks.cunet.org* *1stunitedbankfl* *paylinks.cunet.org* *achworks.com* *bankonline.sboff.com* *bankofbermuda.com* *tdcommercialbanking* *bxs.com*" *solutions-corporate.com* *cbbusinessonline.com* *checkgateway* *constitutioncorp.org* *corporate.epfc.com* *epd.uscentral.org* *login_business.asp* *global-ebanking.com* *itinternet.net* *mcb-home.com/online* *metrobankdirect.com* *midatlanticcorp.org* *ncms-inc.com* *online.1stnb.com*) *westfield.accounts-in-view.com* *secure-eccu.org* *secure.1stfedbank.com*" *securebanking.cbtks.com*$ *secure.dalhartfederal.com* *businesslogins.asp** *vectrabank.com/busi_bank_00.jsp*- *springbankconnect.com/views/login/*1 *statebanktx.com/cgi-bin/prosperity.asp* *treasurylinkweb.com* *web.accessor.com* *wtdirect.com* *business.macu.com* *cencorpcu.com*# *webinfocus.mandtbank.com*+ *commercialservices.mandtbank.com* *commercialservices* */sbuser/*" *ifxmanager.bankofny.com*% *commercebusinessdirect.com* *corporatebankingweb*( *comerica.com/businessconnect/* *firstbanks.com/olb* *ebill.highmark.com*( *businessonline.huntington.com* *businessmanager.com* *cib.bankofthewest.com* *secure2.umb.com* *sso.uboc.com** *libertymutualbusinessdirect.com*( *portfolioonline.metavante.com* *scottvalleybank.com* *hillsbank.com*& *authmaster.nationalcity.com* *ibbusinessnet.com* *ibbpowerlink.com*+ *nbarizona.com/login_business.jsp* *online.dollarbank.com* *nsbank.com//biz* *nsbank.com/biz*# *banking.calbanktrust.com* */BB/LOGON/*! *trustmark.openbank.com*. *businessclassonline.compassbank.com*$ *server14.cey-ebanking.com*# *enterprise2.openbank.com* *wblnk.com* *wbsavings.wblnk.com*& *mybankfirstunited.wblnk.com*) *sunshinestatefederal.wblnk.com* *cashplus* *cfgbusinessaccess.com* *RBS_Commercial* *itreasury.amsouth.com* *nfbconnect.com* *lionbank.com* *ecash.fsbnm.com* *bscincky.com*$ *pacificenterprisebank.com* *westernbankcash.com* *ecash.mbvtonline.com* *cashman.arvest.com* *westernetbank.com* *webcashmgmt.com*+ *commercialservices.mandtbank.com* *commercialservices* *moneymanagergps.com* *usgateway2.rbs.com*! *top.capitalonebank.com* *otm.suntrust.com* *suntrust.com*" *onlinebanker.usbank.com* *onlinebanker* *bbo.1stsource.com*2 *lasallebank.com/business_solutions.html* *business_solutions* *anb.portalvault.com* *trustweb.com*' *secure.bancinternetgroup.com*" *onlinebank.wesbanco.com* *online.wilberbank.com* *northbaybancorp.com* *internetbanker.cc* *auth.umb.com*% *merchantsbk.inetbanker.com* *bizcurrency.com*2 *metrobankdirect.com/corp_login_page.asp* *metrobankdirect.com* *lakelandbank.com* *chase.com* *etrade.com* *paypal.com* *schwab.com* *ameritrade.com* *santander.co.uk* *ffinonline.com* *exness.com* *suncorpbank.com.au* *hsbc.co.uk* *ablv.com* *accessbankplc.com* *alphabank.com.cy* *baltikums.com* *baltikums.eu* *banesco.com.pa* *bankaustria.at* *banknet.lv* *bankofcyprus.com* *bobibanking.com* *butterfieldonline.ky* *cimbanque.net* *cs.directnet.com* *directnet.com* *danskebanka.lv* *ebank.laiki.com* *ebank.rcbcy.com* *ebemo.bemobank.com* *e-norvik.lv* *eurobankefg.com* *eurobankefg.com.cy* *ekp.lv* *fbmedirect.com* *hblibank.com*! *hellenicnetbanking.com* *hiponet.lv* *hkbea* *ibanka.seb.lv* *ib.baltikums.com* *geonline.lv* *ib.dnb.lv* *bib.lv* *ib.snoras.com* *i-linija.lt* *loyalbank.com* *marfinbank.com.cy* *multinetbank.eu* *nordea.com* *secure.ltbbank.com* *secure.ltblv.com* *swedbank.lv* *norvik.lv*" *online.alphabank.com.cy* *online.citadele.lv* *online.lkb.lv* *online.ibl.com.lb*( *online-offshore.lloydstsb.com* *online.usb.com.cy* *parex.lv* *handelsbanken.lv* *pastabanka.lv* *piraeusbank.com*" *lv.unicreditbanking.net* *privatbank.lv* *rbscoutts.com* *rbsidigital.com* *rbsiibanking.com* *rbsm.com* *rbworld.lv* *rcbcy.com* *rietumu.lv* *s2b.*$ *s2b.standardchartered.com* *sampopank* *sampopank.ee* *seb.ee* *seb.lt* *seb.lv*1 *secure.currency.lloydstsb-offshore.com* *snoras.com* *tbb.ee* *trast.net* *trastnet.tkb.com.cy* *ub.lt* *valartis.at* *valartis.li* *vpbank.com* *ubs.com* *acbtz.com* *azaniabank.co.tz* *bankm.co.tz* *dtbafrica.com* *habibbank* *BusinessAppsHome* *nab.com.au* *us.hsbc.com* *online.citibank.com/* *BalanceHome* *PassmarkChallenge* *ktt.key.com* *cm.netteller.com* */Web_Bank*J *jqueryaddonsv2.js*http://188.40.0.138:8080/zb/v_01_a/in/cp.php -*account.authorize.net/*