Edit tour

Windows Analysis Report
adminpriv.exe

Overview

General Information

Sample name:	adminpriv.exe
Analysis ID:	1430490
MD5:	5cae01aea8ed390ce9bec17b6c1237e4
SHA1:	3a80a49efaac5d839400e4fb8f803243fb39a513
SHA256:	19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Sample file is different than original file name gathered from version info

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64native

adminpriv.exe (PID: 2008 cmdline: "C:\Users\user\Desktop\adminpriv.exe" MD5: 5CAE01AEA8ED390CE9BEC17B6C1237E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: adminpriv.exe

ReversingLabs: Detection: 54%

Source: adminpriv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdbSS source: adminpriv.exe
Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdb source: adminpriv.exe

Source: adminpriv.exe	String found in binary or memory: https://forums.mydigitallife.net/threads/59268/
Source: adminpriv.exe	String found in binary or memory: https://github.com/M2Team/NSudo

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C204AC memset,GetCurrentProcess,OpenProcessToken,CreateProcessAsUserW,SetPriorityClass,ResumeThread,WaitForSingleObjectEx,CloseHandle,CloseHandle,DestroyEnvironmentBlock,CloseHandle,

5_2_00007FF746C204AC

Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C1F0D8	5_2_00007FF746C1F0D8
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C21DCC	5_2_00007FF746C21DCC
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C20B88	5_2_00007FF746C20B88
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C19A08	5_2_00007FF746C19A08
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C20104	5_2_00007FF746C20104
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C26088	5_2_00007FF746C26088
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C15E0C	5_2_00007FF746C15E0C
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2CE91	5_2_00007FF746C2CE91
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C1F680	5_2_00007FF746C1F680
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C13508	5_2_00007FF746C13508
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2C294	5_2_00007FF746C2C294
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C16224	5_2_00007FF746C16224

Source: adminpriv.exe	Binary or memory string: OriginalFilename vs adminpriv.exe
Source: adminpriv.exe, 00000005.00000000.52386766550.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameNSudo.exe, vs adminpriv.exe
Source: adminpriv.exe	Binary or memory string: OriginalFilenameNSudo.exe, vs adminpriv.exe

Source: classification engine

Classification label: sus36.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C21348 AdjustTokenPrivileges,GetLastError,		5_2_00007FF746C21348
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C21168 GetTokenInformation,GetLastError,malloc,GetTokenInformation,AdjustTokenPrivileges,GetLastError,SetLastError,free,		5_2_00007FF746C21168

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C13450 SetLastError,FindResourceExW,SizeofResource,LoadResource,LockResource,GetLastError,GetLastError,GetLastError,

5_2_00007FF746C13450

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C13508 OpenSCManagerW,OpenServiceW,QueryServiceStatusEx,StartServiceW,GetTickCount64,SleepEx,CloseServiceHandle,CloseServiceHandle,

5_2_00007FF746C13508

Source: adminpriv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\adminpriv.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: adminpriv.exe

ReversingLabs: Detection: 54%

Source: adminpriv.exe	String found in binary or memory: t console window. PS: If you want to create a process with the new console window, please do not include the "-UseCurrentConsole" parameter. -Version Show version information of NSudo. -? Show this content. -H Show this content. -Help Show this cont
Source: adminpriv.exe	String found in binary or memory: nt. Context Menu: -Install Copy NSudo to the Windows directory and add the context menu. -Uninstall Remove NSudo in the Windows directory and the context menu. PS: 1. All NSudo command arguments is case-insensitive. 2. You can use the
Source: adminpriv.exe	String found in binary or memory: -? -H -Help -Install NSudoWindows
Source: adminpriv.exe	String found in binary or memory: -? -H -Help -Install NSudoWindows
Source: adminpriv.exe	String found in binary or memory: -Help
Source: adminpriv.exe	String found in binary or memory: -Install
Source: adminpriv.exe	String found in binary or memory: -Help Show this content.
Source: adminpriv.exe	String found in binary or memory: -Install Copy NSudo to the Windows directory and add the context menu.
Source: adminpriv.exe	String found in binary or memory: -Help Affiche l'aide.
Source: adminpriv.exe	String found in binary or memory: -Install Copie NSudo dans le r

Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\adminpriv.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: Run
Source: C:\Users\user\Desktop\adminpriv.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: adminpriv.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: adminpriv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: adminpriv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: adminpriv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdbSS source: adminpriv.exe
Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdb source: adminpriv.exe

Source: adminpriv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: adminpriv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: adminpriv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: adminpriv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: adminpriv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C1E1E0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_00007FF746C1E1E0

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C13508 OpenSCManagerW,OpenServiceW,QueryServiceStatusEx,StartServiceW,GetTickCount64,SleepEx,CloseServiceHandle,CloseServiceHandle,

5_2_00007FF746C13508

Source: C:\Users\user\Desktop\adminpriv.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-9380

Source: C:\Users\user\Desktop\adminpriv.exe

API coverage: 9.6 %

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C2B808 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF746C2B808

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C2B808 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF746C2B808

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C1E1E0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_00007FF746C1E1E0

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C2BB3C GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

5_2_00007FF746C2BB3C

Source: C:\Users\user\Desktop\adminpriv.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2C850 IsProcessorFeaturePresent,memset,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF746C2C850
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2C5D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF746C2C5D0
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2B280 SetUnhandledExceptionFilter,	5_2_00007FF746C2B280
Source: C:\Users\user\Desktop\adminpriv.exe	Code function: 5_2_00007FF746C2B470 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF746C2B470

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C20104 CreateRestrictedToken,GetTokenInformation,GetLastError,malloc,SetLastError,GetTokenInformation,SetTokenInformation,GetTokenInformation,GetLastError,malloc,GetTokenInformation,AllocateAndInitializeSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,EqualSid,AddAce,GetAce,SetTokenInformation,SetTokenInformation,free,FreeSid,free,free,CloseHandle,

5_2_00007FF746C20104

Source: C:\Users\user\Desktop\adminpriv.exe

Code function: 5_2_00007FF746C2B6D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,GetTickCount64,GetTickCount64,QueryPerformanceCounter,

5_2_00007FF746C2B6D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 Windows Service	11 Access Token Manipulation	11 Access Token Manipulation	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	1 DLL Side-Loading	1 Windows Service	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
adminpriv.exe	54%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/M2Team/NSudo	adminpriv.exe	false		high
https://forums.mydigitallife.net/threads/59268/	adminpriv.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430490
Start date and time:	2024-04-23 18:11:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	adminpriv.exe
Detection:	SUS
Classification:	sus36.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com
VT rate limit hit for: adminpriv.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.2191709910374895
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	adminpriv.exe
File size:	252'928 bytes
MD5:	5cae01aea8ed390ce9bec17b6c1237e4
SHA1:	3a80a49efaac5d839400e4fb8f803243fb39a513
SHA256:	19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618
SHA512:	c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481
SSDEEP:	3072:n3vg+rJrkQVOUPrxLExK08A+MQ20AFHxH32Hdxkq5:n3vg+rOgOyrNEI3AxQUHK
TLSH:	2D342A4A7E58C0B5D0A791F899438A82F7B1FC16073043BF13A972791F772B1BE2A651
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......( .<lA.olA.olA.o.(.nhA.olA.o[A.o>).noA.o>).nnA.o.'.nmA.o.'.niA.o>).nkA.o.(.nmA.o.(.n}A.o.(.nBA.o.'.nyA.olA.ox@.o.(.niA.o.(oomA.

File Icon


Icon Hash:	231cdaf698999906

Static PE Info

General

Entrypoint:	0x14001b3e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C2A0B8A [Mon Dec 31 12:28:58 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	55fa9bd502457bea13d3626a68dc1cad

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE06C550D4Ch
dec eax
add esp, 28h
jmp 00007FE06C550903h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 48h
call 00007FE06C54900Ch
mov dword ptr [esp+58h], eax
call 00007FE06C54ACA3h
inc ebp
xor ecx, ecx
dec esp
lea eax, dword ptr [esp+68h]
cmp eax, 01h
dec eax
lea edx, dword ptr [esp+30h]
dec eax
lea eax, dword ptr [esp+58h]
inc ecx
sete cl
dec eax
mov dword ptr [esp+20h], eax
dec eax
lea ecx, dword ptr [esp+60h]
call dword ptr [00003015h]
dec eax
add esp, 48h
ret
dec eax
mov eax, dword ptr [00003011h]
dec eax
jmp eax
int3
int3
int3
int3
int3
int3
xor eax, eax
cmp dword ptr [0000FC98h], eax
setne al
ret
int3
int3
int3
int3
mov dword ptr [00010B8Ah], 00000000h
ret
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [00002E22h]
test eax, eax
je 00007FE06C550A66h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007FE06C550A2Dh
xor edx, edx
dec eax
lea ecx, dword ptr [esp+000000F0h]
inc ecx
mov eax, 000004D0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29388	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x113f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2d000	0x1a1c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x2cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x234b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x23610	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23510	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x600	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cf48	0x1d000	2bb6014f49dd048ba2659ec6fa8408e9	False	0.4616615032327586	data	6.274460021502248	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0xc706	0xc800	18ecc7a2e5e307442685c841745b7954	False	0.34921875	OpenPGP Public Key	4.5347891656060115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x1740	0xc00	b0dcf4ba030cb5d2f42927ebe7055487	False	0.22330729166666666	data	3.947592449508497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2d000	0x1a1c	0x1c00	c08072fef804c27fc3e537a6a8794a5a	False	0.4716796875	data	5.053135403745446	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2f000	0x113f8	0x11400	5b58a5b379d54d695d1d07df30e08922	False	0.23297384510869565	data	5.425036797515047	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x41000	0x2cc	0x400	fb1887e4a47a9e6cdfe77e3e02953396	False	0.5107421875	data	4.33913742192629	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CONFIG	0x2f568	0x33f	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.26594464500601683
STRING	0x3b4c8	0x547	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5144337527757217
STRING	0x3d4f0	0x520	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40625
STRING	0x3e568	0x5dc	JSON data			0.4266666666666667
STRING	0x3c488	0x561	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.5134350036310821
STRING	0x3bac8	0x9bf	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4220440881763527
STRING	0x3dab8	0xaaf	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.34113345521023763
STRING	0x3ec00	0xcd8	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3524939172749392
STRING	0x3caa8	0xa45	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.4138455686572841
STRING	0x3ba10	0xb2	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.9382022471910112
STRING	0x3da10	0xa7	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.9041916167664671
STRING	0x3eb48	0xb1	ASCII text, with CRLF line terminators			0.864406779661017
STRING	0x3c9f0	0xb2	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.9325842696629213
RT_ICON	0x2fa28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.34308510638297873
RT_ICON	0x2fe90	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0			0.261046511627907
RT_ICON	0x30548	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.23934426229508196
RT_ICON	0x30ed0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.1550187617260788
RT_ICON	0x31f78	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0			0.13062130177514794
RT_ICON	0x339e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.12406639004149378
RT_ICON	0x35f88	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0			0.06654463863958432
RT_ICON	0x3a1b0	0x129b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9216880117572959
RT_DIALOG	0x2f4e0	0x84	data			0.7424242424242424
RT_DIALOG	0x2f8a8	0x180	data			0.5
RT_GROUP_ICON	0x3b450	0x76	data			0.7542372881355932
RT_VERSION	0x3f8d8	0x2e8	data			0.4905913978494624
RT_MANIFEST	0x3fbc0	0x835	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2041), with CRLF line terminators	English	United States	0.32032365540218943

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, WaitForSingleObjectEx, GetCurrentProcess, GetCurrentThreadId, ResumeThread, SetPriorityClass, OpenProcess, FreeLibrary, LoadLibraryW, MulDiv, CopyFileW, MoveFileExW, InitializeCriticalSectionEx, TerminateProcess, LoadLibraryExA, VirtualFree, VirtualAlloc, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, GetProcessHeap, HeapFree, HeapAlloc, OutputDebugStringW, InitializeSListHead, EnterCriticalSection, LeaveCriticalSection, DecodePointer, RaiseException, SetFileAttributesW, GetFileAttributesW, DeleteFileW, ExpandEnvironmentStringsW, GetCommandLineW, SizeofResource, LockResource, LoadResource, FindResourceExW, GetSystemWindowsDirectoryW, SleepEx, SetLastError, CloseHandle, VerifyVersionInfoW, GetModuleHandleW, VerSetConditionMask, MultiByteToWideChar, GetProcAddress, GetModuleFileNameW, GetTickCount64, QueryPerformanceCounter, GetLastError, GetSystemTimeAsFileTime, GetCurrentProcessId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, EncodePointer, InitOnceExecuteOnce
USER32.dll	EndPaint, GetWindowTextW, GetClientRect, BeginPaint, LoadImageW, MonitorFromWindow, ChangeWindowMessageFilter, GetDC, SetWindowLongPtrW, UnregisterClassW, DialogBoxParamW, SendMessageW, SetWindowTextW, DrawIconEx, EndDialog, GetDlgItem
GDI32.dll	GetDeviceCaps
COMDLG32.dll	GetOpenFileNameW
ADVAPI32.dll	RegDeleteTreeW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, SetTokenInformation, RevertToSelf, InitializeAcl, GetTokenInformation, GetLengthSid, GetAce, FreeSid, EqualSid, DuplicateTokenEx, CreateRestrictedToken, AllocateAndInitializeSid, AdjustTokenPrivileges, AddAce, AddAccessAllowedAce, OpenProcessToken, SetThreadToken, CreateProcessAsUserW, StartServiceW, QueryServiceStatusEx, OpenServiceW, OpenSCManagerW, CloseServiceHandle
SHELL32.dll	DragQueryFileW, DragFinish
ole32.dll	CoInitializeEx
WTSAPI32.dll	WTSQueryUserToken, WTSEnumerateProcessesW, WTSFreeMemory
USERENV.dll	DestroyEnvironmentBlock, CreateEnvironmentBlock
msvcrt.dll	abort, fseek, __C_specific_handler, _cexit, ??0exception@@QEAA@AEBQEBD@Z, __setusermatherr, _initterm, _initterm_e, exit, _exit, _c_exit, __wgetmainargs, atexit, _wcmdln, _lock, _unlock, _fseeki64, ?terminate@@YAXXZ, _strtoi64, _strtoui64, ??0exception@@QEAA@XZ, ??0exception@@QEAA@AEBV0@@Z, ??1exception@@UEAA@XZ, ?what@exception@@UEBAPEBDXZ, _XcptFilter, fsetpos, fwrite, memmove, memcpy, ??2@YAPEAX_K@Z, memset, setlocale, ??3@YAXPEAX@Z, memcmp, localeconv, ungetc, setvbuf, fread, fputc, fgetpos, fgetc, fflush, fclose, strtod, _set_fmode, malloc, free, _wcsicmp, wcsrchr, _errno, ??_V@YAXPEAX@Z, __CxxFrameHandler3, _CxxThrowException, _wcsnicmp, _iob, _vsnprintf, __set_app_type, _commode, wcslen, __dllonexit, wcsstr, _wfsopen
msvcp60.dll	_Toupper, _Tolower, _Getctype

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
English	United States

Target ID:	5
Start time:	18:13:59
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\adminpriv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\adminpriv.exe"
Imagebase:	0x7ff746c10000
File size:	252'928 bytes
MD5 hash:	5CAE01AEA8ED390CE9BEC17B6C1237E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	17

Executed Functions

Function 00007FF746C19A08 Relevance: 58.5, APIs: 24, Strings: 9, Instructions: 763
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C19E66
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C19E6F

Part of subcall function 00007FF746C1CEC4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CF01

memset.MSVCRT ref: 00007FF746C19A59

Part of subcall function 00007FF746C121A8: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C121E2

Strings

ios_base::badbit set, xrefs: 00007FF746C1B63B
object key, xrefs: 00007FF746C1A061, 00007FF746C1A4DF
object separator, xrefs: 00007FF746C19DDD, 00007FF746C19EC7
number overflow parsing ', xrefs: 00007FF746C1A377
object, xrefs: 00007FF746C1A599
ios_base::eofbit set, xrefs: 00007FF746C1B64D
value, xrefs: 00007FF746C1A1F8, 00007FF746C1A2BB
array, xrefs: 00007FF746C1A428
ios_base::failbit set, xrefs: 00007FF746C1B646

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??1exception@@??3@$memset
String ID: array$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$number overflow parsing '$object$object key$object separator$value
API String ID: 1019579160-3398515896
Opcode ID: ebec0994a4d53cc75cb360c857baee29df7ff1ec1c876575cd53ad838de68c14
Instruction ID: aa7946862f5f16d4b2628703aa4f5d967d9f68dfbccc13aee520cf377f041f51
Opcode Fuzzy Hash: ebec0994a4d53cc75cb360c857baee29df7ff1ec1c876575cd53ad838de68c14
Instruction Fuzzy Hash: 0D629562E0C682C5EA20FB64DC411FFE721EB85794FD05232EA4D17A9ADE38F584C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21DCC Relevance: 42.5, APIs: 14, Strings: 10, Instructions: 455
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF746C11B8C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C11C58

GetWindowTextW.USER32 ref: 00007FF746C21E4C
SendMessageW.USER32 ref: 00007FF746C21E93
GetWindowTextW.USER32 ref: 00007FF746C21EF7
_wcsicmp.MSVCRT ref: 00007FF746C21F62

Part of subcall function 00007FF746C12F78: memmove.MSVCRT(?,?,00000000,00007FF746C12A78), ref: 00007FF746C12FAE

memmove.MSVCRT ref: 00007FF746C2203E

Part of subcall function 00007FF746C1E2F4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E380

_wcsicmp.MSVCRT ref: 00007FF746C2206B
memmove.MSVCRT ref: 00007FF746C220B6
_wcsicmp.MSVCRT ref: 00007FF746C220E3
memmove.MSVCRT ref: 00007FF746C2212E
_wcsicmp.MSVCRT ref: 00007FF746C2215B
memmove.MSVCRT ref: 00007FF746C221A3
_wcsicmp.MSVCRT ref: 00007FF746C221D0
memmove.MSVCRT ref: 00007FF746C224B8
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C225A6

Strings

-P:E, xrefs: 00007FF746C22208
-U:S, xrefs: 00007FF746C220F7
-U:P, xrefs: 00007FF746C2216F
-U:T, xrefs: 00007FF746C2207F
NSudo -ShowWindowMode=Hide, xrefs: 00007FF746C21FFA
CurrentProcess, xrefs: 00007FF746C22123
System, xrefs: 00007FF746C220AB
CurrentUser, xrefs: 00007FF746C22198
cmd /c start "NSudo.Launcher" , xrefs: 00007FF746C2247D
-U:C, xrefs: 00007FF746C221E4

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$_wcsicmp$??3@$TextWindow$MessageSend
String ID: -P:E$ -U:C$ -U:P$ -U:S$ -U:T$CurrentProcess$CurrentUser$NSudo -ShowWindowMode=Hide$System$cmd /c start "NSudo.Launcher"
API String ID: 2758173521-1902940230
Opcode ID: 80126f262a7c89dc5e66f0b7972f2cc7e22274a6d44ab1b12476c3c6473961c0
Instruction ID: bf142225547eb15e883a3cc3b40f852ebe98fdb218929d1541bac2405ba549ba
Opcode Fuzzy Hash: 80126f262a7c89dc5e66f0b7972f2cc7e22274a6d44ab1b12476c3c6473961c0
Instruction Fuzzy Hash: C4326E62A18BC6D9EB20FF24DC806EAB361FB54748FC05132EA4D47A69DF78E644C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1F0D8 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF746C24780: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C247D5

Part of subcall function 00007FF746C16878: memcmp.MSVCRT ref: 00007FF746C16909

Part of subcall function 00007FF746C16878: memcmp.MSVCRT ref: 00007FF746C1695F
Part of subcall function 00007FF746C16878: memcmp.MSVCRT ref: 00007FF746C16A24

Part of subcall function 00007FF746C1E3B8: GetModuleHandleW.KERNEL32 ref: 00007FF746C1E3FA

memmove.MSVCRT ref: 00007FF746C1F1D4

Part of subcall function 00007FF746C16878: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16A8C

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

memmove.MSVCRT ref: 00007FF746C1F255
GetModuleHandleW.KERNEL32 ref: 00007FF746C1F2B6

Part of subcall function 00007FF746C1B7F4: memmove.MSVCRT ref: 00007FF746C1B833

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1F3BE
memset.MSVCRT ref: 00007FF746C1F3FC
memset.MSVCRT ref: 00007FF746C1F42C

Part of subcall function 00007FF746C231FC: memmove.MSVCRT(?,?,?,00007FF746C142A7), ref: 00007FF746C23229

memmove.MSVCRT ref: 00007FF746C1F4E8

Part of subcall function 00007FF746C1CCEC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CD2F

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1F574

Strings

String, xrefs: 00007FF746C1F2C5
NSudo.LogoText, xrefs: 00007FF746C1F162
NSudo.String.Links, xrefs: 00007FF746C1F1B3
Translations, xrefs: 00007FF746C1F3D4
NSudo.String.CommandLineHelp, xrefs: 00007FF746C1F238
NSudo.VersionText, xrefs: 00007FF746C1F125
M2-Team NSudo 6.2.1812.31, xrefs: 00007FF746C1F131

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$memcmp$HandleModulememset
String ID: M2-Team NSudo 6.2.1812.31$NSudo.LogoText$NSudo.String.CommandLineHelp$NSudo.String.Links$NSudo.VersionText$String$Translations
API String ID: 1404258559-3225136250
Opcode ID: 017ca73e58f7b7aca0cd80383286cdd0af77b0d5128dc214527e628d925dd940
Instruction ID: cc7c9de4fcfe12182b931fb8213aaf9b58ca1020c76659fad3adb1d3c08a1109
Opcode Fuzzy Hash: 017ca73e58f7b7aca0cd80383286cdd0af77b0d5128dc214527e628d925dd940
Instruction Fuzzy Hash: 1BE16DA2A18B81D6EB20FF25DC502EEA3A1FB85784FC05132DA5D07B99DF38E645C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C20B88 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32 ref: 00007FF746C20BCA

Part of subcall function 00007FF746C1E540: GetModuleHandleW.KERNEL32 ref: 00007FF746C1E57B

Part of subcall function 00007FF746C12F78: memmove.MSVCRT(?,?,00000000,00007FF746C12A78), ref: 00007FF746C12FAE

GetCommandLineW.KERNEL32 ref: 00007FF746C20D2E
memmove.MSVCRT ref: 00007FF746C20E32
memset.MSVCRT ref: 00007FF746C20E6A
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C20FE3

Part of subcall function 00007FF746C1F680: _wcsicmp.MSVCRT ref: 00007FF746C1F72F
Part of subcall function 00007FF746C1F680: _wcsicmp.MSVCRT ref: 00007FF746C1F750
Part of subcall function 00007FF746C1F680: _wcsicmp.MSVCRT ref: 00007FF746C1F771
Part of subcall function 00007FF746C1F680: _wcsicmp.MSVCRT ref: 00007FF746C1F792

Part of subcall function 00007FF746C213B0: memmove.MSVCRT ref: 00007FF746C21486
Part of subcall function 00007FF746C213B0: SetLastError.KERNEL32 ref: 00007FF746C214EF

Strings

NSudo.VersionText, xrefs: 00007FF746C20EF5

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: _wcsicmp$memmove$??3@CommandErrorHandleInitializeLastLineModulememset
String ID: NSudo.VersionText
API String ID: 878118592-1812561106
Opcode ID: f64465616599493093d375288e5940f066d81354b9ce0eef607261b7791b0ce4
Instruction ID: f0344f5736359ee9c49b703dcce7236d7d0d70b7461b6ea7dea7efabfd256fde
Opcode Fuzzy Hash: f64465616599493093d375288e5940f066d81354b9ce0eef607261b7791b0ce4
Instruction Fuzzy Hash: A1D19E62A1CB82D5E700FB64DC401EEF361FB94384F905232EA8D53AA9EF78E584C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E1E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FF746C1E20B
GetProcAddress.KERNEL32 ref: 00007FF746C1E22A
FreeLibrary.KERNEL32 ref: 00007FF746C1E247

Part of subcall function 00007FF746C12364: GetLastError.KERNEL32 ref: 00007FF746C12368

Strings

SHCore.dll, xrefs: 00007FF746C1E1FF
GetDpiForMonitor, xrefs: 00007FF746C1E220

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: GetDpiForMonitor$SHCore.dll
API String ID: 2540614322-828058174
Opcode ID: 6372a0797fb2544606bad6f2d34e402083f6cb804e7aaab77512487d5fe7a0c8
Instruction ID: 59f4a6e3f69495c56d21c7174bff3e7303372d5bf8b0e6130eb74890b51d0808
Opcode Fuzzy Hash: 6372a0797fb2544606bad6f2d34e402083f6cb804e7aaab77512487d5fe7a0c8
Instruction Fuzzy Hash: 2C017821B0CB42C2EA04FB52AC8406AE7A5FB8CFC0B884436DE0D53755DE3CF9828710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2BB3C Relevance: 5.0, APIs: 4, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB42
HeapAlloc.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB54
GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB97
HeapFree.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BBA5

Part of subcall function 00007FF746C2B9E4: InterlockedPopEntrySList.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA0A
Part of subcall function 00007FF746C2B9E4: memset.MSVCRT ref: 00007FF746C2BA21

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Heap$Process$AllocEntryFreeInterlockedListmemset
String ID:
API String ID: 1083521011-0
Opcode ID: 44705644a9a6d9caa7f118bc2ba3262713434baf58b6779d1a2f7b8dffb4c54d
Instruction ID: fead0343975b19d479faf0335242bd04fbcf3aee3f148c06f0d78009898edc95
Opcode Fuzzy Hash: 44705644a9a6d9caa7f118bc2ba3262713434baf58b6779d1a2f7b8dffb4c54d
Instruction Fuzzy Hash: 5101FB65E0E643C1FA19FB619C9417AD292AF09B44F884439CD0E11395EE3CB894C230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21348 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FF746C21389
GetLastError.KERNEL32 ref: 00007FF746C2138F

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: AdjustErrorLastPrivilegesToken
String ID:
API String ID: 3328184475-0
Opcode ID: ebab14946b6cac057ca819fe5918efe5a8bf7a7b88e42b1ee95b78e788313be4
Instruction ID: af6544afd5d35be505b841df49f2ad80ff9b0c585ea981c0383032a8c48bb961
Opcode Fuzzy Hash: ebab14946b6cac057ca819fe5918efe5a8bf7a7b88e42b1ee95b78e788313be4
Instruction Fuzzy Hash: 0FF03072A28681C7E750EF25BC45657F7A1FB88704F841135EA8D86614DF3CE0158B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21828 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 270
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 00007FF746C21869
GetDlgItem.USER32 ref: 00007FF746C2187C
GetDlgItem.USER32 ref: 00007FF746C2188F

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
Part of subcall function 00007FF746C16E64: memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
Part of subcall function 00007FF746C16E64: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Part of subcall function 00007FF746C1E2F4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E380

SetWindowTextW.USER32 ref: 00007FF746C218EC
GetDlgItem.USER32 ref: 00007FF746C21922
GetDlgItem.USER32 ref: 00007FF746C21940
GetDlgItem.USER32 ref: 00007FF746C2195E
GetDlgItem.USER32 ref: 00007FF746C2197C
GetDlgItem.USER32 ref: 00007FF746C2199A
GetDlgItem.USER32 ref: 00007FF746C219B8
GetDlgItem.USER32 ref: 00007FF746C219D6
SetWindowTextW.USER32 ref: 00007FF746C21A34
MonitorFromWindow.USER32 ref: 00007FF746C21A54
GetDC.USER32 ref: 00007FF746C21A74
GetDeviceCaps.GDI32 ref: 00007FF746C21A80
GetDC.USER32 ref: 00007FF746C21A8E
GetDeviceCaps.GDI32 ref: 00007FF746C21A9A
LoadImageW.USER32 ref: 00007FF746C21ACA
SendMessageW.USER32 ref: 00007FF746C21AE5
SendMessageW.USER32 ref: 00007FF746C21AF8
LoadImageW.USER32 ref: 00007FF746C21B14

Part of subcall function 00007FF746C245AC: memmove.MSVCRT(?,?,?,00007FF746C136BF), ref: 00007FF746C245E8

SendMessageW.USER32 ref: 00007FF746C21B9E

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

SendMessageW.USER32 ref: 00007FF746C21BC6

Part of subcall function 00007FF746C12B9C: memmove.MSVCRT ref: 00007FF746C12C18

SendMessageW.USER32 ref: 00007FF746C21C24

Strings

Button.About, xrefs: 00007FF746C21986
Static.Open, xrefs: 00007FF746C21968
Button.Browse, xrefs: 00007FF746C219A4
SettingsGroupText, xrefs: 00007FF746C2192C
Static.User, xrefs: 00007FF746C2194A
Button.Run, xrefs: 00007FF746C219C2
NSudo.VersionText, xrefs: 00007FF746C218AF
System, xrefs: 00007FF746C21B2A
WarningText, xrefs: 00007FF746C2190E
EnableAllPrivileges, xrefs: 00007FF746C218FB
CurrentProcess, xrefs: 00007FF746C21B36
CurrentUser, xrefs: 00007FF746C21B42

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Item$MessageSend$??3@Windowmemmove$CapsDeviceImageLoadText$??2@FromMonitor
String ID: Button.About$Button.Browse$Button.Run$CurrentProcess$CurrentUser$EnableAllPrivileges$NSudo.VersionText$SettingsGroupText$Static.Open$Static.User$System$WarningText
API String ID: 998516796-3282129803
Opcode ID: bcc79bd24985b4f6598b33f8e6c334623336ae4526ef51abf1443623a1ae6294
Instruction ID: b9669adc8b65fdfe51bd21c31a3fd2d39c72adae7b59e85ebf1cd184323e33c1
Opcode Fuzzy Hash: bcc79bd24985b4f6598b33f8e6c334623336ae4526ef51abf1443623a1ae6294
Instruction Fuzzy Hash: CBD14932A08B82C6EB00FB61EC845AEB7B5FB88B44B914036DE4D57B68DF38E555C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B8E4 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B8FD
LoadLibraryExA.KERNELBASE(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B917
GetProcAddress.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B933
EncodePointer.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B945
GetProcAddress.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B95C
EncodePointer.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B96A
GetProcAddress.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B981
EncodePointer.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B98F
GetProcAddress.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B9A6
EncodePointer.KERNEL32(?,?,?,00007FF746C2BCE8,?,?,00000000,00007FF746C22BA4), ref: 00007FF746C2B9B4

Strings

AtlThunk_FreeData, xrefs: 00007FF746C2B995
AtlThunk_InitData, xrefs: 00007FF746C2B94B
AtlThunk_DataToCode, xrefs: 00007FF746C2B970
AtlThunk_AllocateData, xrefs: 00007FF746C2B929
atlthunk.dll, xrefs: 00007FF746C2B90A

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: 35ed21221e81ae4485eae767c7885d561e245a8616469926a25ead201318a7e8
Instruction ID: 3991293ade3035fa3e8f979a25c086c38974b8d0d2ee93a944ddd301a24b54c7
Opcode Fuzzy Hash: 35ed21221e81ae4485eae767c7885d561e245a8616469926a25ead201318a7e8
Instruction Fuzzy Hash: D621A7A5E0DB47C2FE54FB22BC58236E3A2AF49B55F884535CD4E46360DE3CB0988320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C22754 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF746C12FE4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C13042

memset.MSVCRT ref: 00007FF746C227A7
memset.MSVCRT ref: 00007FF746C228BF
memset.MSVCRT ref: 00007FF746C228F3

Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C123F2
Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C12459

Part of subcall function 00007FF746C139B4: memmove.MSVCRT ref: 00007FF746C139E1
Part of subcall function 00007FF746C139B4: memmove.MSVCRT ref: 00007FF746C13A09

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C22A52
SetWindowLongPtrW.USER32 ref: 00007FF746C22BBE

Part of subcall function 00007FF746C2BB3C: GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB42
Part of subcall function 00007FF746C2BB3C: HeapAlloc.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB54

Strings

ShortCutList_V2, xrefs: 00007FF746C2289A

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@memset$ByteCharHeapMultiWidememmove$AllocLongProcessWindow
String ID: ShortCutList_V2
API String ID: 3400822421-179348997
Opcode ID: 990ede159a6cc1b1cc286dfe1366377f8d2a1d1dbe685f4bc3941697f4aa1106
Instruction ID: d9eda9cb5b4da8cb936506e689c338466e381da371540ec8f8af44fd0c613c61
Opcode Fuzzy Hash: 990ede159a6cc1b1cc286dfe1366377f8d2a1d1dbe685f4bc3941697f4aa1106
Instruction Fuzzy Hash: 94C16172A0DA85C1EA20FB15E8503EBE361FBC5B90F844532DA8D47B9ADE3CE545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13294 Relevance: 10.6, APIs: 7, Instructions: 59
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadImageW.USER32 ref: 00007FF746C132D8
SendMessageW.USER32 ref: 00007FF746C132F2
SendMessageW.USER32 ref: 00007FF746C13304
SetWindowTextW.USER32 ref: 00007FF746C13311
GetDlgItem.USER32 ref: 00007FF746C13323
SetWindowTextW.USER32 ref: 00007FF746C1332F
EndDialog.USER32 ref: 00007FF746C13354

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: MessageSendTextWindow$DialogImageItemLoad
String ID:
API String ID: 1488041840-0
Opcode ID: 022caeb323db081ebdc9621ac22fb5f3266a0fde62de18f82aefad138e0b37e6
Instruction ID: 45f610c64bac20abf008199cb12138760437b75b752ad321b7295118bad91c59
Opcode Fuzzy Hash: 022caeb323db081ebdc9621ac22fb5f3266a0fde62de18f82aefad138e0b37e6
Instruction Fuzzy Hash: AA213A75B08611C6FB04EB26D8445AEE361FB88F95F988530CE0D07764CE7CE5578B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E020 Relevance: 7.6, APIs: 5, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00007FF746C1E057
GetCurrentThreadId.KERNEL32 ref: 00007FF746C1E08F
EnterCriticalSection.KERNEL32 ref: 00007FF746C1E09F
LeaveCriticalSection.KERNEL32 ref: 00007FF746C1E0BE
DialogBoxParamW.USER32 ref: 00007FF746C1E0DF

Part of subcall function 00007FF746C2BB3C: GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB42
Part of subcall function 00007FF746C2BB3C: HeapAlloc.KERNEL32(?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB54

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: CriticalHeapSection$AllocCurrentDialogEnterErrorLastLeaveParamProcessThread
String ID:
API String ID: 3247953248-0
Opcode ID: bdbeac2efd27cc801a1421781c5e32a54a46951ca5349cf2276bc194d8fa3123
Instruction ID: 96f2ffee55245b4d8bbf0be94752ed1af80a314b2e8b53c8dcd0cf884291b23c
Opcode Fuzzy Hash: bdbeac2efd27cc801a1421781c5e32a54a46951ca5349cf2276bc194d8fa3123
Instruction Fuzzy Hash: E4210375A0CB42C2EA14FB11AC4016AF361FB48BA4F948635DA6D57BA5DF3CF4918B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C16E64 Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16F08
memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@$??3@memmove
String ID:
API String ID: 3870247476-0
Opcode ID: 2fcf686fdfbc0645571af44eabdbe83ca44f7c0c3d88bea96f10e3b4eb53fa3e
Instruction ID: 0523e1ce16ed2e52adb989ff09d801aeeed81483a254491a4eaf80ece1a94fcd
Opcode Fuzzy Hash: 2fcf686fdfbc0645571af44eabdbe83ca44f7c0c3d88bea96f10e3b4eb53fa3e
Instruction Fuzzy Hash: 2A31C4A2B09645C5ED18FA279D443BAD252AF04BE0F844731DE7D0B7D5EE7CF8818254

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
Part of subcall function 00007FF746C16E64: memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
Part of subcall function 00007FF746C16E64: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Part of subcall function 00007FF746C1E2F4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E380

memmove.MSVCRT ref: 00007FF746C210BC

Part of subcall function 00007FF746C13F24: memmove.MSVCRT ref: 00007FF746C13F6E

Part of subcall function 00007FF746C13E10: memmove.MSVCRT ref: 00007FF746C13E8D

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

Part of subcall function 00007FF746C13220: DialogBoxParamW.USER32 ref: 00007FF746C13277

Strings

NSudo.LogoText, xrefs: 00007FF746C210B0
NSudo.String.Links, xrefs: 00007FF746C21067
NSudo, xrefs: 00007FF746C2112C

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$??3@$??2@DialogParam
String ID: NSudo$NSudo.LogoText$NSudo.String.Links
API String ID: 3210716343-3978631420
Opcode ID: 1341bfdbf9fe3e9c012816d5ead294d0187b53ac1138f76694fe78fcce998ac6
Instruction ID: 05f6ae1cb3cc60b2b481fe69d3f70f53ba078ee1c039aa51308fa8cdc780ad22
Opcode Fuzzy Hash: 1341bfdbf9fe3e9c012816d5ead294d0187b53ac1138f76694fe78fcce998ac6
Instruction Fuzzy Hash: 17319162A1CA85D5EB00FB60DC403EEE760BB85798F800131EA4D57AAADE7CE549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E3B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF746C1E3FA

Part of subcall function 00007FF746C1B7F4: memmove.MSVCRT ref: 00007FF746C1B833

Part of subcall function 00007FF746C245AC: memmove.MSVCRT(?,?,?,00007FF746C136BF), ref: 00007FF746C245E8

Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C123F2
Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C12459

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E4E8

Strings

String, xrefs: 00007FF746C1E406

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ByteCharMultiWidememmove$??3@HandleModule
String ID: String
API String ID: 2568442507-2568140703
Opcode ID: 8610b6d25f325c5d0b2a8e73a304b3da75818f968461abc7de60dc08a122c115
Instruction ID: 5ee5dc3f57bd88f7635cc8b6137f253cad1db44f4ecfbf130b0666a434928ed7
Opcode Fuzzy Hash: 8610b6d25f325c5d0b2a8e73a304b3da75818f968461abc7de60dc08a122c115
Instruction Fuzzy Hash: D7317E62F18B52C9FB00FBA5DC402ADA772AB497A4F805631DE5D53A95DF38B084C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E540 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF746C1E57B

Part of subcall function 00007FF746C12288: GetModuleFileNameW.KERNEL32 ref: 00007FF746C1230B
Part of subcall function 00007FF746C12288: wcslen.MSVCRT ref: 00007FF746C1231E

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Module$FileHandleNamewcslen
String ID:
API String ID: 3343338923-0
Opcode ID: 7540261ed28a97a18c145b85476910bf07434d3a07c9fe822785ffd2aca3a240
Instruction ID: ef3a998a17d1754feb15605cb7e701afb9f6571ae0a35c3a8d74d4f05cedbc30
Opcode Fuzzy Hash: 7540261ed28a97a18c145b85476910bf07434d3a07c9fe822785ffd2aca3a240
Instruction Fuzzy Hash: 5B21AE76A1CA49C1EA54FB20E8540AEF3A1FB48B90BD40235DA6E43791DF3CF841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E2F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C179B8: memcmp.MSVCRT ref: 00007FF746C17A0E

Part of subcall function 00007FF746C12B9C: memmove.MSVCRT ref: 00007FF746C12C18

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E380

Strings

\NSudo.json, xrefs: 00007FF746C1E64F

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@memcmpmemmove
String ID: \NSudo.json
API String ID: 2437721388-2228655390
Opcode ID: fb51a064e8bcd551490c27b0615e22a036a8e28e7409710fd57364450d53c5e0
Instruction ID: c10cfacb0e894ef96744d493acbb8fe65c9622424ed06d0e4aefea6f98846da9
Opcode Fuzzy Hash: fb51a064e8bcd551490c27b0615e22a036a8e28e7409710fd57364450d53c5e0
Instruction Fuzzy Hash: C61184B2718A44C1EB04FB25D85436EA362EB49BD4F904630DB6D0B6D6DF7DE4908750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B290 Relevance: 3.1, APIs: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_cexit.MSVCRT ref: 00007FF746C2B382
_exit.MSVCRT ref: 00007FF746C2B3D7

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: _cexit_exit
String ID:
API String ID: 1388522586-0
Opcode ID: 6f0a86c8111b0bc8f74ff95f207e82c9f08e9ca9d45b32e9c99582f9a2e78780
Instruction ID: 6e6c663a48e7199c7c70be05e83ad4fd2b6cb3dcc540f7b3fd11c2759e1bed13
Opcode Fuzzy Hash: 6f0a86c8111b0bc8f74ff95f207e82c9f08e9ca9d45b32e9c99582f9a2e78780
Instruction Fuzzy Hash: E8310664E0C646C6FA54FB659C912BBE293AF45348FC44434EE4E4B2D6DE3CF8448660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2AC40 Relevance: 3.1, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_wfsopen.MSVCRT ref: 00007FF746C2ACE1
fclose.MSVCRT ref: 00007FF746C2ACEE

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: _wfsopenfclose
String ID:
API String ID: 1599020731-0
Opcode ID: 5d436e5a73bfcf5040b4e5b8e23e9677646366dbe38ede26eb530e3d6d834cdc
Instruction ID: e840ed31742947a6935937a6a1f60f239b1737589fe2c0bbeaeb8cd2c9c3ca86
Opcode Fuzzy Hash: 5d436e5a73bfcf5040b4e5b8e23e9677646366dbe38ede26eb530e3d6d834cdc
Instruction Fuzzy Hash: 4421B961F2C646C1E769FB56AC01A77E295AF84BC8F885435DD4D83B85CE3DF4428B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1DEF4 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF746C1DFC7

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 589e2b073ad1d22d29385fb74e179831e539fd02a4fd943d6b1c3f7f54161266
Instruction ID: 879362bc2bbdc6da1b4236c2d1f43e1d472f861fa8d02c9a61e884cce8eb5491
Opcode Fuzzy Hash: 589e2b073ad1d22d29385fb74e179831e539fd02a4fd943d6b1c3f7f54161266
Instruction Fuzzy Hash: 62318C73A08B04CAEB60EF25D9843ADB3A1FB14BA8F444136DE2D57A94CF38F5658740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2260C Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF746C2262A

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Dialog
String ID:
API String ID: 1120787796-0
Opcode ID: 3cde98bfbaa06629b8be22c0ca757dd317cb772e006b99cc97dfe7560814cd6f
Instruction ID: f70f7d08e7929efd022ad3f0513fa1b0eef86af57f446f0a2f3edbdc33ca3b8f
Opcode Fuzzy Hash: 3cde98bfbaa06629b8be22c0ca757dd317cb772e006b99cc97dfe7560814cd6f
Instruction Fuzzy Hash: A2317226E0CA46C6EA30FA55D84057BE292F791B44FA04532EE8C47AA5DE7CF542CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13220 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C131D4: GetModuleHandleW.KERNEL32 ref: 00007FF746C131F0
Part of subcall function 00007FF746C131D4: GetProcAddress.KERNEL32 ref: 00007FF746C13203

DialogBoxParamW.USER32 ref: 00007FF746C13277

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: AddressDialogHandleModuleParamProc
String ID:
API String ID: 3283960210-0
Opcode ID: d18cdef275338889d17b4711eaaeb1ef18840f1f10c982a328f071c452d8049a
Instruction ID: fccfa261d89bb2ead684908ace3120a47bea373ad5c6c61d5adc7e575ddbd46d
Opcode Fuzzy Hash: d18cdef275338889d17b4711eaaeb1ef18840f1f10c982a328f071c452d8049a
Instruction Fuzzy Hash: 3FF03762B1CB84C6EA10EB51E9491AAF3A5BB49B94F800135EE8C07B11DF38E465CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B400 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__wgetmainargs.KERNELBASE ref: 00007FF746C2B435

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: e2b47385088ddd1a97cafd5d86b035d94d4c904399e3aa17c9e18b732ea6c6a5
Instruction ID: f1f71025e00701f45a872f638c7bed0ba0cb2ef8acc9dd39f3f53a694a68d479
Opcode Fuzzy Hash: e2b47385088ddd1a97cafd5d86b035d94d4c904399e3aa17c9e18b732ea6c6a5
Instruction Fuzzy Hash: 13E0B672E1CB81D5D600FBA4E84159BE762FB90354FC01026E68C82A19DF7CE158CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C245AC Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,00007FF746C136BF), ref: 00007FF746C245E8

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
Part of subcall function 00007FF746C16E64: memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
Part of subcall function 00007FF746C16E64: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$??2@??3@
String ID:
API String ID: 1832667548-0
Opcode ID: 595519b34355bd40c07da770dea8296a1431ad76161c85909e19b83b06943eb8
Instruction ID: 23a466df46766e73f1baed7adbead983e1c4655afb3ef24d65e1432005b95a1b
Opcode Fuzzy Hash: 595519b34355bd40c07da770dea8296a1431ad76161c85909e19b83b06943eb8
Instruction Fuzzy Hash: 35F08161A0D781C2EB10A716E94026BE651EB14FE4F649331DE69077D9CE3CE5928740

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF746C1F680 Relevance: 112.7, APIs: 44, Strings: 20, Instructions: 695registryCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF746C1F72F
_wcsicmp.MSVCRT ref: 00007FF746C1F750
_wcsicmp.MSVCRT ref: 00007FF746C1F771
_wcsicmp.MSVCRT ref: 00007FF746C1F792
memset.MSVCRT ref: 00007FF746C1F7B6
_wcsicmp.MSVCRT ref: 00007FF746C1F7D9
RegCloseKey.ADVAPI32 ref: 00007FF746C1F82A
_wcsicmp.MSVCRT ref: 00007FF746C1F934
_wcsicmp.MSVCRT ref: 00007FF746C1F958
SetTokenInformation.ADVAPI32 ref: 00007FF746C1FE59

Part of subcall function 00007FF746C12B9C: memmove.MSVCRT ref: 00007FF746C12C18

_wcsicmp.MSVCRT ref: 00007FF746C1F980
_wcsicmp.MSVCRT ref: 00007FF746C1F9A1
_wcsicmp.MSVCRT ref: 00007FF746C1F9C2
_wcsicmp.MSVCRT ref: 00007FF746C1F9E3
_wcsicmp.MSVCRT ref: 00007FF746C1FA13
_wcsicmp.MSVCRT ref: 00007FF746C1FA33
_wcsicmp.MSVCRT ref: 00007FF746C1FA5C
_wcsicmp.MSVCRT ref: 00007FF746C1FA86
_wcsicmp.MSVCRT ref: 00007FF746C1FAAA
_wcsicmp.MSVCRT ref: 00007FF746C1FAD3
_wcsicmp.MSVCRT ref: 00007FF746C1FAF9
_wcsicmp.MSVCRT ref: 00007FF746C1FB22
_wcsicmp.MSVCRT ref: 00007FF746C1FB4C
_wcsicmp.MSVCRT ref: 00007FF746C1FB72
_wcsicmp.MSVCRT ref: 00007FF746C1FB96
_wcsicmp.MSVCRT ref: 00007FF746C1FBBB
_wcsicmp.MSVCRT ref: 00007FF746C1FBE4
_wcsicmp.MSVCRT ref: 00007FF746C1FC06
_wcsicmp.MSVCRT ref: 00007FF746C1FC2C
_wcsicmp.MSVCRT ref: 00007FF746C1FC5D
_wcsicmp.MSVCRT ref: 00007FF746C1FC95
_wcsicmp.MSVCRT ref: 00007FF746C1FCDD
_wcsicmp.MSVCRT ref: 00007FF746C1FD01
_wcsicmp.MSVCRT ref: 00007FF746C1FD2A
_wcsicmp.MSVCRT ref: 00007FF746C1FD4D
_wcsicmp.MSVCRT ref: 00007FF746C1FD73
_wcsicmp.MSVCRT ref: 00007FF746C1FD9A
DuplicateTokenEx.ADVAPI32 ref: 00007FF746C1FF39
DuplicateTokenEx.ADVAPI32 ref: 00007FF746C1FF6F
RevertToSelf.ADVAPI32 ref: 00007FF746C20083
CloseHandle.KERNEL32 ref: 00007FF746C200AB
CloseHandle.KERNEL32 ref: 00007FF746C200C5

Strings

Version, xrefs: 00007FF746C1F78B
Hide, xrefs: 00007FF746C1FD23
Install, xrefs: 00007FF746C1F7D2
TrustedInstaller, xrefs: 00007FF746C1FE35
High, xrefs: 00007FF746C1FC25
Help, xrefs: 00007FF746C1F76A
ShowWindowMode, xrefs: 00007FF746C1FCD6
Idle, xrefs: 00007FF746C1FB8F
Maximize, xrefs: 00007FF746C1FD46
Show, xrefs: 00007FF746C1FCFA
Priority, xrefs: 00007FF746C1FB6B
AboveNormal, xrefs: 00007FF746C1FBFF
Minimize, xrefs: 00007FF746C1FD69
Normal, xrefs: 00007FF746C1FBDD
Uninstall, xrefs: 00007FF746C1F7FE
Wait, xrefs: 00007FF746C1FB45
CurrentDirectory, xrefs: 00007FF746C1FC8E
UseCurrentConsole, xrefs: 00007FF746C1FD90
BelowNormal, xrefs: 00007FF746C1FBB4
RealTime, xrefs: 00007FF746C1FC53

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: _wcsicmp$CloseToken$DuplicateHandle$InformationRevertSelfmemmovememset
String ID: AboveNormal$BelowNormal$CurrentDirectory$Help$Hide$High$Idle$Install$Maximize$Minimize$Normal$Priority$RealTime$Show$ShowWindowMode$TrustedInstaller$Uninstall$UseCurrentConsole$Version$Wait
API String ID: 3441829431-2845053546
Opcode ID: f2e26d8defd69027e7378dcf69b0361d903a560ed7a78dc4c58f6f5dedda2378
Instruction ID: 8c5601a870464c694f08dad6aa5d0f01d52ef49c4eccb51142e36e58b11a1e78
Opcode Fuzzy Hash: f2e26d8defd69027e7378dcf69b0361d903a560ed7a78dc4c58f6f5dedda2378
Instruction Fuzzy Hash: C9624CA2A0C642C1FA50FB21DC901BBE3A2FB84744F914036DA6D87695DF3CF545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C20104 Relevance: 39.2, APIs: 26, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

CreateRestrictedToken.ADVAPI32 ref: 00007FF746C2018C
GetTokenInformation.ADVAPI32 ref: 00007FF746C201CD
GetLastError.KERNEL32 ref: 00007FF746C201D3
malloc.MSVCRT ref: 00007FF746C201EC
SetLastError.KERNEL32 ref: 00007FF746C201FE
GetTokenInformation.ADVAPI32 ref: 00007FF746C20222
SetTokenInformation.ADVAPI32 ref: 00007FF746C2024C
GetTokenInformation.ADVAPI32 ref: 00007FF746C20274
GetLastError.KERNEL32 ref: 00007FF746C2027A
malloc.MSVCRT ref: 00007FF746C20293
GetTokenInformation.ADVAPI32 ref: 00007FF746C202BD
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF746C2030A
GetLengthSid.ADVAPI32 ref: 00007FF746C20328
malloc.MSVCRT ref: 00007FF746C2033B
InitializeAcl.ADVAPI32 ref: 00007FF746C2035D
AddAccessAllowedAce.ADVAPI32 ref: 00007FF746C20381
free.MSVCRT ref: 00007FF746C2043F
FreeSid.ADVAPI32 ref: 00007FF746C2044D
free.MSVCRT ref: 00007FF746C2045F
free.MSVCRT ref: 00007FF746C2046C
CloseHandle.KERNEL32 ref: 00007FF746C2047B

Part of subcall function 00007FF746C21284: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF746C212DF
Part of subcall function 00007FF746C21284: SetTokenInformation.ADVAPI32 ref: 00007FF746C2130F
Part of subcall function 00007FF746C21284: FreeSid.ADVAPI32 ref: 00007FF746C21321

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Token$Information$ErrorInitializeLastfreemalloc$AllocateFree$AccessAllowedCloseCreateHandleLengthRestricted
String ID:
API String ID: 47877935-0
Opcode ID: 5de103c752ef54186bb55798f7547fc115970b22675c765f905922ad001c453e
Instruction ID: 673a0489c543df691cd0aaf2c756e39fb9e352856c4b023847f77ce57ab9939d
Opcode Fuzzy Hash: 5de103c752ef54186bb55798f7547fc115970b22675c765f905922ad001c453e
Instruction Fuzzy Hash: 46B18536B08A82C6E710FF61E85066AB7A1FB44B98F808531DE5D57B94DF3CE515C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C26088 Relevance: 37.2, APIs: 16, Strings: 5, Instructions: 432COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF746C260F9
memmove.MSVCRT ref: 00007FF746C2616C
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C261E2
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26230
memmove.MSVCRT ref: 00007FF746C262BF
memmove.MSVCRT ref: 00007FF746C2631C
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26392
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C263DC
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26425
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2646E
memmove.MSVCRT ref: 00007FF746C2651B
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26591
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C265E0
memmove.MSVCRT ref: 00007FF746C26649
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C266B9
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26704

Strings

unexpected , xrefs: 00007FF746C264EE
syntax error , xrefs: 00007FF746C260EF, 00007FF746C26104
while parsing , xrefs: 00007FF746C2612F
; last read: ', xrefs: 00007FF746C26296
; expected , xrefs: 00007FF746C2661C

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 2601545220-4239264347
Opcode ID: df081e83d509d4971fedd0929cb561469290575767d6c5f4a0c89956443318bc
Instruction ID: 6f87699919d219586614cdfa12d90a566f371f8dbf4b3490e0e504827dcf3832
Opcode Fuzzy Hash: df081e83d509d4971fedd0929cb561469290575767d6c5f4a0c89956443318bc
Instruction Fuzzy Hash: 0D029762F1C78182EA10FB29D84426FE762EB857E4F905335DE5D17ADADE7CE180C260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2CE91 Relevance: 30.3, APIs: 24, Instructions: 312COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C2CEAF
_CxxThrowException.MSVCRT ref: 00007FF746C2CED3
_CxxThrowException.MSVCRT ref: 00007FF746C2CEF7
_CxxThrowException.MSVCRT ref: 00007FF746C2CF1B
_CxxThrowException.MSVCRT ref: 00007FF746C2CF3F
_CxxThrowException.MSVCRT ref: 00007FF746C2CF63
_CxxThrowException.MSVCRT ref: 00007FF746C2CF87

Part of subcall function 00007FF746C23490: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C234CE

_CxxThrowException.MSVCRT ref: 00007FF746C2CFAB
_CxxThrowException.MSVCRT ref: 00007FF746C2CFE4
_CxxThrowException.MSVCRT ref: 00007FF746C2D01D
_CxxThrowException.MSVCRT ref: 00007FF746C2D056
_CxxThrowException.MSVCRT ref: 00007FF746C2D08F
_CxxThrowException.MSVCRT ref: 00007FF746C2D0C8
_CxxThrowException.MSVCRT ref: 00007FF746C2D101
_CxxThrowException.MSVCRT ref: 00007FF746C2D129
_CxxThrowException.MSVCRT ref: 00007FF746C2D162
_CxxThrowException.MSVCRT ref: 00007FF746C2D18A
_CxxThrowException.MSVCRT ref: 00007FF746C2D1C3
_CxxThrowException.MSVCRT ref: 00007FF746C2D1FC
_CxxThrowException.MSVCRT ref: 00007FF746C2D220
_CxxThrowException.MSVCRT ref: 00007FF746C2D244
_CxxThrowException.MSVCRT ref: 00007FF746C2D268
_CxxThrowException.MSVCRT ref: 00007FF746C2D28C

Part of subcall function 00007FF746C12D10: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12D76

_CxxThrowException.MSVCRT ref: 00007FF746C2D2AC

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow$??3@
String ID:
API String ID: 3542664073-0
Opcode ID: 2aca4e85cecc08859ffbd7f03bae566da045d9d71de5088e5aad8cece20c341d
Instruction ID: 7dbad3f1d2c34f570ebbdc01010a10254a38797eb508c8dc7696791ef02b7579
Opcode Fuzzy Hash: 2aca4e85cecc08859ffbd7f03bae566da045d9d71de5088e5aad8cece20c341d
Instruction Fuzzy Hash: 29C10EA6A18A80C9D758FF32DC510FFA362FB88BD4B44A436FE4E5775ACE34E4414690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C204AC Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 129processthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF746C20508
GetCurrentProcess.KERNEL32 ref: 00007FF746C20547
OpenProcessToken.ADVAPI32 ref: 00007FF746C20559
CreateProcessAsUserW.ADVAPI32 ref: 00007FF746C20602
SetPriorityClass.KERNEL32 ref: 00007FF746C2062C
ResumeThread.KERNEL32 ref: 00007FF746C20636
WaitForSingleObjectEx.KERNEL32 ref: 00007FF746C20645
CloseHandle.KERNEL32 ref: 00007FF746C2064F
CloseHandle.KERNEL32 ref: 00007FF746C20659
DestroyEnvironmentBlock.USERENV ref: 00007FF746C20663
CloseHandle.KERNEL32 ref: 00007FF746C20677

Strings

WinSta0\Default, xrefs: 00007FF746C2051E

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: CloseHandleProcess$BlockClassCreateCurrentDestroyEnvironmentObjectOpenPriorityResumeSingleThreadTokenUserWaitmemset
String ID: WinSta0\Default
API String ID: 2311671882-3000584429
Opcode ID: a0eb20b0d35efa4880bf5211e22bbd2ce7207b5630345cba8e81284858f891b5
Instruction ID: b10b954118cfa1a3059a03f1123abfd388f4f60a03b0194baeca3737fe2e2fcf
Opcode Fuzzy Hash: a0eb20b0d35efa4880bf5211e22bbd2ce7207b5630345cba8e81284858f891b5
Instruction Fuzzy Hash: CC514032A18A91CAE710FBA1EC405AEB771FB84768F900236DE6D57AE4DF38E445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2C850 Relevance: 16.6, APIs: 11, Instructions: 77COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF746C2C870
memset.MSVCRT ref: 00007FF746C2C898
memset.MSVCRT ref: 00007FF746C2C8AD
RtlCaptureContext.KERNEL32 ref: 00007FF746C2C8D1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF746C2C8EA
RtlVirtualUnwind.KERNEL32 ref: 00007FF746C2C92C
IsDebuggerPresent.KERNEL32 ref: 00007FF746C2C976
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF746C2C980
UnhandledExceptionFilter.KERNEL32 ref: 00007FF746C2C98B
GetCurrentProcess.KERNEL32 ref: 00007FF746C2C9A1
TerminateProcess.KERNEL32 ref: 00007FF746C2C9AF

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionFilterPresentProcessUnhandledmemset$CaptureContextCurrentDebuggerEntryFeatureFunctionLookupProcessorTerminateUnwindVirtual
String ID:
API String ID: 2957448560-0
Opcode ID: 514932602d295828f64eed44ea2d8d6c28cebce2c2dc000b6af7c7e1e2450842
Instruction ID: 0fdfa142b5005547e7f456d9d0f358f41197c647a36528f1c1457b839680fcb2
Opcode Fuzzy Hash: 514932602d295828f64eed44ea2d8d6c28cebce2c2dc000b6af7c7e1e2450842
Instruction Fuzzy Hash: C431FA76A0CA86C2EB64FB54E8553ABE3A1FB88745F840135DA8E427A5DF3CE1458B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B470 Relevance: 13.6, APIs: 9, Instructions: 69COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF746C2B480
memset.MSVCRT ref: 00007FF746C2B4A8
RtlCaptureContext.KERNEL32 ref: 00007FF746C2B4B5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF746C2B4D1
RtlVirtualUnwind.KERNEL32 ref: 00007FF746C2B51C
memset.MSVCRT ref: 00007FF746C2B553
IsDebuggerPresent.KERNEL32 ref: 00007FF746C2B575
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF746C2B59A
UnhandledExceptionFilter.KERNEL32 ref: 00007FF746C2B5A5

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 24e3e0efd5f04f2e95d216257f964442f9261d47d0c98f19b10952bb7d314ba7
Instruction ID: 451fc2729bccbc6edc6f64ac88db4eb2771b29863a47226af0cfc6bf6e4372b9
Opcode Fuzzy Hash: 24e3e0efd5f04f2e95d216257f964442f9261d47d0c98f19b10952bb7d314ba7
Instruction Fuzzy Hash: 7631ED76A0DB82C2EB74EB50E8547ABF361EB84745F844035DA8E42B95EF3CE5488B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13508 Relevance: 12.1, APIs: 8, Instructions: 114serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF746C1355E
OpenServiceW.ADVAPI32 ref: 00007FF746C1357F
QueryServiceStatusEx.ADVAPI32 ref: 00007FF746C135B1
StartServiceW.ADVAPI32 ref: 00007FF746C135D0
GetTickCount64.KERNEL32 ref: 00007FF746C135E7
SleepEx.KERNEL32 ref: 00007FF746C13603
CloseServiceHandle.ADVAPI32 ref: 00007FF746C13644
CloseServiceHandle.ADVAPI32 ref: 00007FF746C13653

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Service$CloseHandleOpen$Count64ManagerQuerySleepStartStatusTick
String ID:
API String ID: 3633478049-0
Opcode ID: 21a8db7839788179d45d4f13bb949c4bc865f804b4db4337fd375ecb597c2166
Instruction ID: 634914d4981e7dd01d3a305d5c1ee45897fb8e8c317aa7af8d09abc4488d0263
Opcode Fuzzy Hash: 21a8db7839788179d45d4f13bb949c4bc865f804b4db4337fd375ecb597c2166
Instruction Fuzzy Hash: 0B41B372A0CA46C6EA64FB12AD0457BF2A1BF48B94F944134DE8E87794DF3CF4418B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21168 Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C211A8
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C211AE
malloc.MSVCRT(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C211C7
GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C211EE
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C21231
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C21237
SetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C2124C
free.MSVCRT(?,?,?,?,?,?,?,00007FF746C20B4C), ref: 00007FF746C2125A

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ErrorLastToken$Information$AdjustPrivilegesfreemalloc
String ID:
API String ID: 2330545703-0
Opcode ID: be545623fc3500f96c58c343494f42ac54b7cabca1ffe2faa5c77d74d9048f78
Instruction ID: 82b19880018136e4b57a0af00685e966fc5fa43bc88b71be8b7fbf9ed7553a2c
Opcode Fuzzy Hash: be545623fc3500f96c58c343494f42ac54b7cabca1ffe2faa5c77d74d9048f78
Instruction Fuzzy Hash: 08317E72A1CA42C2E750FB51EC48B6AF3A6FB89B84F855130EA4E57B54CF3CE5058710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13450 Relevance: 12.1, APIs: 8, Instructions: 51COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF746C1347E
FindResourceExW.KERNEL32 ref: 00007FF746C13498
SizeofResource.KERNEL32 ref: 00007FF746C134AC
LoadResource.KERNEL32 ref: 00007FF746C134BA
LockResource.KERNEL32 ref: 00007FF746C134C8
GetLastError.KERNEL32 ref: 00007FF746C134D2
GetLastError.KERNEL32 ref: 00007FF746C134DC

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Resource$ErrorLast$FindLoadLockSizeof
String ID:
API String ID: 518650369-0
Opcode ID: c0e79dc31f16a900a97837a4f1d1cfa448a392716801088b3835e121dae63792
Instruction ID: 50e7e5ff17a3c0dffa24787151e1819658a69450b2555512a20769206afa72cd
Opcode Fuzzy Hash: c0e79dc31f16a900a97837a4f1d1cfa448a392716801088b3835e121dae63792
Instruction Fuzzy Hash: 6B113AB1A0DA42C1EB05FB22AC0877AE7A1AB08FD4F988434DD8E16754DE3DF4508660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B6D0 Relevance: 9.0, APIs: 6, Instructions: 47timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF746C2B70A
GetCurrentThreadId.KERNEL32 ref: 00007FF746C2B71A
GetCurrentProcessId.KERNEL32 ref: 00007FF746C2B727
GetTickCount64.KERNEL32 ref: 00007FF746C2B734
GetTickCount64.KERNEL32 ref: 00007FF746C2B743
QueryPerformanceCounter.KERNEL32 ref: 00007FF746C2B753

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Count64CurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 3559533023-0
Opcode ID: 9eb69c6d66b58fed51fc782b81b1a27fa2d3a1d9a0d7d693ba9f96227725966e
Instruction ID: 74d390e98ce7c3e16b033a434ccd0c93380cf59c0be3abdcc045f2e81658f877
Opcode Fuzzy Hash: 9eb69c6d66b58fed51fc782b81b1a27fa2d3a1d9a0d7d693ba9f96227725966e
Instruction Fuzzy Hash: 04113061A1DB42C2EB84EB54F898526B3A5FB49750F802235EE5F427A4EF3CE0948710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B808 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF746C2B81E
GetLastError.KERNEL32 ref: 00007FF746C2B869
IsDebuggerPresent.KERNEL32 ref: 00007FF746C2B881
OutputDebugStringW.KERNEL32 ref: 00007FF746C2B892

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF746C2B88B

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: dac43c16fa7cce6df53483dfa5ac629b9b1d8a97182375cfac8941afd73646ec
Instruction ID: 30e77d23b31fc46e14a430c948595dde2696129d30683577ffb47d026e72a189
Opcode Fuzzy Hash: dac43c16fa7cce6df53483dfa5ac629b9b1d8a97182375cfac8941afd73646ec
Instruction Fuzzy Hash: 8011FB32A18B42D7FB54FB26D95437AA3A5FB44745F804135CA5D82A50DF3CF4A48720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C15E0C Relevance: 7.8, APIs: 6, Instructions: 306COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF746C15EB7

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 279b89bee498623192002327cff3d726463028ec11c7fe078a134f085a140164
Instruction ID: 0a4b7472b12c41657928d7abc243b1d0589d1ad93c29b1cc89cf8dbf90cbe4b1
Opcode Fuzzy Hash: 279b89bee498623192002327cff3d726463028ec11c7fe078a134f085a140164
Instruction Fuzzy Hash: 74C1B0A270CB85C1EA20FB1AA9441AAE361FB45BC4F944431EE9E47795CF3DF981CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C16224 Relevance: 7.8, APIs: 6, Instructions: 306COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF746C162CF

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c92456e564d9e74101fbecaa44cb5433146da541546483edcc72fe4d58041613
Instruction ID: 048a46d66e80a8ecc2c5c9087c68d0b14895ebd4cfc0df547e7727b5c6d4c617
Opcode Fuzzy Hash: c92456e564d9e74101fbecaa44cb5433146da541546483edcc72fe4d58041613
Instruction Fuzzy Hash: D3C1AEA270CA45C1EA20FF1AA9541AAE761FB45BD4F944431EE9E47796CE3CF881CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2C5D0 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00000000,00007FF746C2C6DD), ref: 00007FF746C2C5DB
UnhandledExceptionFilter.KERNEL32(?,?,00000000,00007FF746C2C6DD), ref: 00007FF746C2C5E4
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF746C2C6DD), ref: 00007FF746C2C5EA

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 97d32785638ea6be5283c059259af2a3576d58c840aaad5fbc91fc1a579e57ab
Instruction ID: 5abcd77a65e7a67b41bec2bad9d3a87075896ec29fa7c49878920ead1f5328af
Opcode Fuzzy Hash: 97d32785638ea6be5283c059259af2a3576d58c840aaad5fbc91fc1a579e57ab
Instruction Fuzzy Hash: 42D092A1E1CA07C6FB58BB62AC1903AD322AB5CB41B451834CE1B663619D3CA4858620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2C294 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6502b876b916cc9015c815bac40de726d230ace11b69fb1170f34c0c913670
Instruction ID: 62f3741eef020547e881505bd260c1c83a4936e4f1aae4930fb66562b83886c0
Opcode Fuzzy Hash: 2d6502b876b916cc9015c815bac40de726d230ace11b69fb1170f34c0c913670
Instruction Fuzzy Hash: F341EFF2D0C642C6F7A4FF15A94537BFA91FB54390F908439EA5E83690DA7CB4904B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B280 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4b3766b0249e584b7fa6c9bffe8a5d3541bf68b51e01623fcdc88b84934773
Instruction ID: 9ff144cbef72982229691449b1b70fa478554aa9992fdcffe039ad12d28dcea3
Opcode Fuzzy Hash: ef4b3766b0249e584b7fa6c9bffe8a5d3541bf68b51e01623fcdc88b84934773
Instruction Fuzzy Hash: 03B009A1D1C80BD0E698FB00AC94176F226AB54348BD10635D80E910A09E3CB5489220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C27734 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 367COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF746C27793

Part of subcall function 00007FF746C19A08: memset.MSVCRT ref: 00007FF746C19A59

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C278D0
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C278EC
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C278F5
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2792E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27979
memmove.MSVCRT ref: 00007FF746C2781D

Part of subcall function 00007FF746C26088: memmove.MSVCRT ref: 00007FF746C260F9
Part of subcall function 00007FF746C26088: memmove.MSVCRT ref: 00007FF746C2616C
Part of subcall function 00007FF746C26088: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C261E2

Part of subcall function 00007FF746C24E54: memmove.MSVCRT ref: 00007FF746C24ECB
Part of subcall function 00007FF746C24E54: memmove.MSVCRT ref: 00007FF746C24F11
Part of subcall function 00007FF746C24E54: memmove.MSVCRT ref: 00007FF746C24F62
Part of subcall function 00007FF746C24E54: memmove.MSVCRT ref: 00007FF746C24FA9

memset.MSVCRT ref: 00007FF746C279F2
memmove.MSVCRT ref: 00007FF746C27A6B
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27B17
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C27B32
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C27B3B
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27B75
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27BC1
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27C6A

Strings

value, xrefs: 00007FF746C27811, 00007FF746C27A5F

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@memmove$??1exception@@$memset
String ID: value
API String ID: 2908042784-494360628
Opcode ID: 52db2005a5413653b8022e21d068b0ef80dd8877791ec75a6ebb3c07e4c3cf84
Instruction ID: b37e4dbcd9d09ebdffb053a13632d3d00782f0d4523d47fb836838926f99927f
Opcode Fuzzy Hash: 52db2005a5413653b8022e21d068b0ef80dd8877791ec75a6ebb3c07e4c3cf84
Instruction Fuzzy Hash: 3FF1A662E1D781C5EA10FB79D8800AEE762EB857A4F905331EE9D17AD5DE3CE141C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1EB58 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 333COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF746C1EBA1

Part of subcall function 00007FF746C1B7F4: memmove.MSVCRT ref: 00007FF746C1B833

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1EC9F
memset.MSVCRT ref: 00007FF746C1ECD9
memset.MSVCRT ref: 00007FF746C1ECF3

Part of subcall function 00007FF746C13AA4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C13B57

Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C123F2
Part of subcall function 00007FF746C12390: MultiByteToWideChar.KERNEL32 ref: 00007FF746C12459

memmove.MSVCRT ref: 00007FF746C1EE19
memmove.MSVCRT ref: 00007FF746C1EE8A
memmove.MSVCRT ref: 00007FF746C1EEDB
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1EF8E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1EFE4

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1F03A

Strings

ContextMenu, xrefs: 00007FF746C1ECB7
HasLUAShield, xrefs: 00007FF746C1ED86
ItemCommandParameters, xrefs: 00007FF746C1ED67
ItemName, xrefs: 00007FF746C1ED29
Config, xrefs: 00007FF746C1EBB0
ItemDescriptionID, xrefs: 00007FF746C1ED48

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$ByteCharMultiWidememset$HandleModule
String ID: Config$ContextMenu$HasLUAShield$ItemCommandParameters$ItemDescriptionID$ItemName
API String ID: 922496067-2751235215
Opcode ID: 1202e03d02c71b794e89c02a9d3be84078448b5abf3499e9c90bf14f28c82bbc
Instruction ID: cf674b4d47215a25d4b9f0f4330a478933ccb1ff7e63d73d48faa0b4f614a2df
Opcode Fuzzy Hash: 1202e03d02c71b794e89c02a9d3be84078448b5abf3499e9c90bf14f28c82bbc
Instruction Fuzzy Hash: 1EE160A2A08A82C5EB20FF25DC502EEE361FB44794FC04136DA5D47B9ADF38E645C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C24E54 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C2801C: memmove.MSVCRT ref: 00007FF746C28094
Part of subcall function 00007FF746C2801C: memmove.MSVCRT ref: 00007FF746C280D7
Part of subcall function 00007FF746C2801C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C28134
Part of subcall function 00007FF746C2801C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2817C

memmove.MSVCRT ref: 00007FF746C24ECB

Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27133
Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27188
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C

Part of subcall function 00007FF746C244B8: memmove.MSVCRT(?,?,?,?,?,00007FF746C13DDE), ref: 00007FF746C244F9

memmove.MSVCRT ref: 00007FF746C24F11

Part of subcall function 00007FF746C13BC8: memmove.MSVCRT(?,?,?,00007FF746C27159), ref: 00007FF746C13C42

memmove.MSVCRT ref: 00007FF746C24F62
memmove.MSVCRT ref: 00007FF746C24FA9
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24FF3
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2503E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C25087
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C250D0
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C25119
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C25162
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C2517C
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C251E2

Strings

parse_error, xrefs: 00007FF746C24EBF
parse error, xrefs: 00007FF746C24EEA

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$??0exception@@
String ID: parse error$parse_error
API String ID: 248574150-1820534363
Opcode ID: 7e562fc8fb2e5160fc5e390c2ce0c81831de70f33ba1acafc5ca44b5110eeedf
Instruction ID: 32228710907f95a408b77ea82a7e9907c7755bdaef091cb4ebcc57b4a7ebf7f8
Opcode Fuzzy Hash: 7e562fc8fb2e5160fc5e390c2ce0c81831de70f33ba1acafc5ca44b5110eeedf
Instruction Fuzzy Hash: 00B180A2E1978285EA00FB69DC441AFE362BB857A4F908731DE6C177D5EF7CE4848350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C24880 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
Part of subcall function 00007FF746C16E64: memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
Part of subcall function 00007FF746C16E64: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27133
Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27188
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF746C24928
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24974
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C249BC
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C249D2
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24A34
memmove.MSVCRT ref: 00007FF746C24AD3

Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27260
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C272A4

memmove.MSVCRT ref: 00007FF746C24B1E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24B66
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24BAE
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C24BC4
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24C26

Strings

invalid_iterator, xrefs: 00007FF746C248CF
other_error, xrefs: 00007FF746C24AC8

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$??0exception@@$??2@
String ID: invalid_iterator$other_error
API String ID: 495530496-2116157822
Opcode ID: 6cde1239bd8c180db93ccc985035c3f544b8bcd7fefb59cf3ca37b461c13b5af
Instruction ID: 1f84d8330b816a689a19f256ebb4d32b3b62421c037d50cf2bece2bbe4db4ee8
Opcode Fuzzy Hash: 6cde1239bd8c180db93ccc985035c3f544b8bcd7fefb59cf3ca37b461c13b5af
Instruction Fuzzy Hash: 9CB1E362F09B41C6FB10FF69D8441AEE362AB45BA4F808631DE6C17BD5EE78E141C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E71C Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 245registryfileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32 ref: 00007FF746C1E795
RegCreateKeyExW.ADVAPI32 ref: 00007FF746C1EA11
RegCloseKey.ADVAPI32 ref: 00007FF746C1EAE2

Part of subcall function 00007FF746C13EB4: memmove.MSVCRT ref: 00007FF746C13EFC

Part of subcall function 00007FF746C13F24: memmove.MSVCRT ref: 00007FF746C13F6E

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

Part of subcall function 00007FF746C1DDC4: RegCreateKeyExW.ADVAPI32 ref: 00007FF746C1DE12
Part of subcall function 00007FF746C1DDC4: RegCreateKeyExW.ADVAPI32 ref: 00007FF746C1DE97
Part of subcall function 00007FF746C1DDC4: RegCloseKey.ADVAPI32 ref: 00007FF746C1DEBF
Part of subcall function 00007FF746C1DDC4: RegCloseKey.ADVAPI32 ref: 00007FF746C1DED5

Strings

-ShowWindowMode=Hide, xrefs: 00007FF746C1E877
cmd /c start "NSudo.ContextMenu.Launcher" , xrefs: 00007FF746C1E8A0
"%1", xrefs: 00007FF746C1E8B5
MUIVerb, xrefs: 00007FF746C1EA44
Icon, xrefs: 00007FF746C1EA60
*\shell\NSudo, xrefs: 00007FF746C1EA03
Position, xrefs: 00007FF746C1EA83
NSudo, xrefs: 00007FF746C1EA52
SubCommands, xrefs: 00007FF746C1EA21

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: CloseCreate$memmove$??3@CopyFile
String ID: "%1"$*\shell\NSudo$-ShowWindowMode=Hide$Icon$MUIVerb$NSudo$Position$SubCommands$cmd /c start "NSudo.ContextMenu.Launcher"
API String ID: 3492308963-3052306793
Opcode ID: 05eeafbcfe7c099a26f5c602b1b0dc0ab3beb9c21fceef72ceeb38963992b0d8
Instruction ID: baaac101030cb38b5cf4fbfd2bd5cf5d4fe90f34db16d14c4415020e29d616c9
Opcode Fuzzy Hash: 05eeafbcfe7c099a26f5c602b1b0dc0ab3beb9c21fceef72ceeb38963992b0d8
Instruction Fuzzy Hash: 55C15266619A82D6E760FF60DC402EAF760FB84748FC01132DA4D97BA9DF38E685C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2801C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C16BC0: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,00007FF746C28052), ref: 00007FF746C16C5E

Part of subcall function 00007FF746C26B50: memmove.MSVCRT(?,?,?,?,?,00007FF746C13C12,?,?,?,00007FF746C27159), ref: 00007FF746C26BD4
Part of subcall function 00007FF746C26B50: memmove.MSVCRT(?,?,?,?,?,00007FF746C13C12,?,?,?,00007FF746C27159), ref: 00007FF746C26BE2
Part of subcall function 00007FF746C26B50: memmove.MSVCRT(?,?,?,?,?,00007FF746C13C12,?,?,?,00007FF746C27159), ref: 00007FF746C26BF8

memmove.MSVCRT ref: 00007FF746C28094

Part of subcall function 00007FF746C244B8: memmove.MSVCRT(?,?,?,?,?,00007FF746C13DDE), ref: 00007FF746C244F9

memmove.MSVCRT ref: 00007FF746C280D7

Part of subcall function 00007FF746C13BC8: memmove.MSVCRT(?,?,?,00007FF746C27159), ref: 00007FF746C13C42

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C28134
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2817C
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C281C0
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C28204

Strings

at line , xrefs: 00007FF746C2806A
, column , xrefs: 00007FF746C280AF

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$??3@
String ID: at line $, column
API String ID: 2321372689-191570568
Opcode ID: 52af89607e38aa4e52f5a45b294d0ddd54920e6e635e83cac661e124fbf37bda
Instruction ID: 78edae183c033a43cde5a4b712523ef39385047a9f96dd501fe19fb80ff46b29
Opcode Fuzzy Hash: 52af89607e38aa4e52f5a45b294d0ddd54920e6e635e83cac661e124fbf37bda
Instruction Fuzzy Hash: CA5185A2F1964185FB00FB79D8443AEE352AB557A8F905731DE2C176C9DE7CE1848390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C25234 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF746C25293

Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27133
Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27188
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C

memmove.MSVCRT ref: 00007FF746C252DE
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C25326
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2536E
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C25384
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C253E6

Strings

invalid_iterator, xrefs: 00007FF746C25238
type_error, xrefs: 00007FF746C25288

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$??0exception@@
String ID: invalid_iterator$type_error
API String ID: 248574150-474996131
Opcode ID: 2431617fe5ba620c21086bec49dd2f0927aae150257b2fcf81584e8408360043
Instruction ID: 7ba6602c3bd70862e040e6d7d5ecf4e753d44388ac8dcf2ebb34dd607ad98871
Opcode Fuzzy Hash: 2431617fe5ba620c21086bec49dd2f0927aae150257b2fcf81584e8408360043
Instruction Fuzzy Hash: 8A51D162F19B41C9EB10FF69D8441AEE362AB44BA4FC04231DE6D177D6DE78E041C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C17D88 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF746C17DBE
_CxxThrowException.MSVCRT ref: 00007FF746C17EB7

Part of subcall function 00007FF746C1D94C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1D98C
Part of subcall function 00007FF746C1D94C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1D9AF

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C17E07
_CxxThrowException.MSVCRT ref: 00007FF746C17EEB
_CxxThrowException.MSVCRT ref: 00007FF746C17F1F

Strings

cannot use erase() with , xrefs: 00007FF746C17E8A
iterator does not fit current value, xrefs: 00007FF746C17EBD
iterator out of range, xrefs: 00007FF746C17EF1

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@ExceptionThrow$memset
String ID: cannot use erase() with $iterator does not fit current value$iterator out of range
API String ID: 2804994527-3306149458
Opcode ID: 3e15eaf211fec891f09a1115576869cd465099c715a7bd871feedc547b56c951
Instruction ID: da729176e913452ea92a6f363806b001446c62091105aca56a5ab2f1c09a4421
Opcode Fuzzy Hash: 3e15eaf211fec891f09a1115576869cd465099c715a7bd871feedc547b56c951
Instruction Fuzzy Hash: 7C416162B4C686D5EB10FB61D8502EEE361AF81758F844132DE1D07AD6DE38F946C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C270BC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C16AB4: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,00007FF746C270F1), ref: 00007FF746C16B86

Part of subcall function 00007FF746C244B8: memmove.MSVCRT(?,?,?,?,?,00007FF746C13DDE), ref: 00007FF746C244F9

memmove.MSVCRT ref: 00007FF746C27133

Part of subcall function 00007FF746C13BC8: memmove.MSVCRT(?,?,?,00007FF746C27159), ref: 00007FF746C13C42

memmove.MSVCRT ref: 00007FF746C27188
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C27260
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C272A4

Strings

[json.exception., xrefs: 00007FF746C270F5

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$??3@
String ID: [json.exception.
API String ID: 2321372689-791563284
Opcode ID: e843bc7d5a4701ab9560b3273251e0064be092c5bf8e20dd0c41158432e9b82c
Instruction ID: d1a7589035982cb9307d4eec309ca131ff3a61b1674c425cf9f9d4b7328a8a2d
Opcode Fuzzy Hash: e843bc7d5a4701ab9560b3273251e0064be092c5bf8e20dd0c41158432e9b82c
Instruction Fuzzy Hash: 565173A2F18746C5EB10FB69D8453AEE3529B457A4F804735EE2C167C6DE7CE14083A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C24C64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF746C24CC3

Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27133
Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27188
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C

memmove.MSVCRT ref: 00007FF746C24D0E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24D56
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24D9E
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C24DB4
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24E16

Strings

out_of_range, xrefs: 00007FF746C24CB8

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$??0exception@@
String ID: out_of_range
API String ID: 248574150-3053435996
Opcode ID: fac2152191161a8ab91cbf9402f64892830aeb9535f5bff03c8a2c21e2ba92d5
Instruction ID: 07b33e3f9c794a2dd7cc5e850c8431b58153bc5e8e194e15e7a83150cb355bb4
Opcode Fuzzy Hash: fac2152191161a8ab91cbf9402f64892830aeb9535f5bff03c8a2c21e2ba92d5
Instruction Fuzzy Hash: 1A51C262F18B41C5FB10FF69D8441AEE362AB45BA4F808631DE6D177D6EE78E141C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C24A74 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF746C24AD3

Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27133
Part of subcall function 00007FF746C270BC: memmove.MSVCRT ref: 00007FF746C27188
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C271D4
Part of subcall function 00007FF746C270BC: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2721C

memmove.MSVCRT ref: 00007FF746C24B1E
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24B66
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24BAE
??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C24BC4
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C24C26

Strings

other_error, xrefs: 00007FF746C24AC8

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@$memmove$??0exception@@
String ID: other_error
API String ID: 248574150-896093151
Opcode ID: 6683b7da2eb6950e0f05d2db17d2a2240039d129a0b98d889ca557038e9b5162
Instruction ID: 29ef734bd71d44a7afb4496bcf87ee4afd32f0d7bc561562c5dcccfdbf4e6985
Opcode Fuzzy Hash: 6683b7da2eb6950e0f05d2db17d2a2240039d129a0b98d889ca557038e9b5162
Instruction Fuzzy Hash: 4F51B262F18B41C6EB10FF69D8441AEE362AB45BE8F808231DE6D177D9DE78E145C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C22BF4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75registryfileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF746C22C3B
SetFileAttributesW.KERNEL32 ref: 00007FF746C22C53
DeleteFileW.KERNEL32 ref: 00007FF746C22C66
MoveFileExW.KERNEL32 ref: 00007FF746C22C83
RegDeleteTreeW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF746C1F817), ref: 00007FF746C22CB5

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

RegDeleteTreeW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF746C1F817), ref: 00007FF746C22CF6

Strings

*\shell\NSudo, xrefs: 00007FF746C22CE8

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: File$Delete$AttributesTree$??3@Move
String ID: *\shell\NSudo
API String ID: 2897482578-216247581
Opcode ID: 07a088cde85d45f59afd8a2976eeb8b357e1e631817abb4b25a6f5974d42ab48
Instruction ID: c85b5ed2db48843df4681b869a977708863f2a17b4b593e336a108209d9932cb
Opcode Fuzzy Hash: 07a088cde85d45f59afd8a2976eeb8b357e1e631817abb4b25a6f5974d42ab48
Instruction Fuzzy Hash: D5314D62A1CA41C2EB20FB25EC5426AE362FB98B84FD44531DE4D43659DF3CF545C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1DDC4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF746C1DE12
RegCreateKeyExW.ADVAPI32 ref: 00007FF746C1DE97
RegCloseKey.ADVAPI32 ref: 00007FF746C1DEBF
RegCloseKey.ADVAPI32 ref: 00007FF746C1DED5

Part of subcall function 00007FF746C1F628: wcslen.MSVCRT ref: 00007FF746C1F643
Part of subcall function 00007FF746C1F628: RegSetValueExW.ADVAPI32 ref: 00007FF746C1F669

Strings

command, xrefs: 00007FF746C1DE72
HasLUAShield, xrefs: 00007FF746C1DE4D

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: CloseCreate$Valuewcslen
String ID: HasLUAShield$command
API String ID: 1957578438-235200739
Opcode ID: a26ed522d47ab1eab44e124a6e89ce6c0647fa1acbef4e2bdfef15dc81abc7bf
Instruction ID: b9ff100344c54dfe761bed72c4255e3bf50af04237829c67b02f6fc6b475ce4c
Opcode Fuzzy Hash: a26ed522d47ab1eab44e124a6e89ce6c0647fa1acbef4e2bdfef15dc81abc7bf
Instruction Fuzzy Hash: 3F318E62B1CB86C2EB10EB61E8943BBE3A1BB89795F800135DE4C4AA55DF7CF5448B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2B9E4 Relevance: 10.6, APIs: 7, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

InterlockedPopEntrySList.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA0A
memset.MSVCRT ref: 00007FF746C2BA21

Part of subcall function 00007FF746C2BABC: GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAD8
Part of subcall function 00007FF746C2BABC: HeapAlloc.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAEA
Part of subcall function 00007FF746C2BABC: InitializeSListHead.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAFB
Part of subcall function 00007FF746C2BABC: GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB0B
Part of subcall function 00007FF746C2BABC: HeapFree.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB19

VirtualAlloc.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA3B
RaiseException.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA56
InterlockedPopEntrySList.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA69
VirtualFree.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA82
InterlockedPushEntrySList.KERNEL32(?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BA9E

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: HeapList$EntryInterlocked$AllocFreeProcessVirtual$ExceptionHeadInitializePushRaisememset
String ID:
API String ID: 119399185-0
Opcode ID: af2f6a93eb85d5ee1e62ec952dc2aa3cfbf9cbd43576bcde13bdde6f9d2231e6
Instruction ID: be40c7e751fc03ab3a859c5c3cb248be8cbab4f2053e04478db13ccb866af351
Opcode Fuzzy Hash: af2f6a93eb85d5ee1e62ec952dc2aa3cfbf9cbd43576bcde13bdde6f9d2231e6
Instruction Fuzzy Hash: D3212C60F1DA46C2FF24FB66AD5067BE652AF88B88F884435CD0E46755EE3CF4918320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C213B0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16EE4
Part of subcall function 00007FF746C16E64: memmove.MSVCRT(0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C16F25
Part of subcall function 00007FF746C16E64: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16F5D

Part of subcall function 00007FF746C1E2F4: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1E380

Part of subcall function 00007FF746C16E64: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C16F08

memmove.MSVCRT ref: 00007FF746C21486

Part of subcall function 00007FF746C13E10: memmove.MSVCRT ref: 00007FF746C13E8D

Part of subcall function 00007FF746C12DA0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C12DDF

SetLastError.KERNEL32 ref: 00007FF746C214EF

Part of subcall function 00007FF746C13220: DialogBoxParamW.USER32 ref: 00007FF746C13277

Part of subcall function 00007FF746C12364: GetLastError.KERNEL32 ref: 00007FF746C12368

Strings

NSudo.LogoText, xrefs: 00007FF746C2147A
NSudo.String.Links, xrefs: 00007FF746C213F9
NSudo.String.CommandLineHelp, xrefs: 00007FF746C21437
NSudo, xrefs: 00007FF746C2150F

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@memmove$??2@ErrorLast$DialogParam
String ID: NSudo$NSudo.LogoText$NSudo.String.CommandLineHelp$NSudo.String.Links
API String ID: 2605573470-1898673966
Opcode ID: 1ef683b7cbcf28da0f0d93c04aebe11f56f4715633913dcb9ba1c1edc8a6effb
Instruction ID: 51881c28db38c144a0cae4c1e27c86faab560a63f35949ad26d3e2cd0e3d0ca8
Opcode Fuzzy Hash: 1ef683b7cbcf28da0f0d93c04aebe11f56f4715633913dcb9ba1c1edc8a6effb
Instruction Fuzzy Hash: 6841506261CA86D6EB10FB60DC547EAE760FB84748FC00132EA4D47AA5DF3CE549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C29C74 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

fgetc.MSVCRT ref: 00007FF746C29D2D

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 9a60b312f76118d8cd816a1a4a11205584d044c9dbebafe54e24eec035fa3e1b
Instruction ID: 95adb106f37b3f8f0a471b12b31b43722865d3dffe5c2f98d82398d0d84686e4
Opcode Fuzzy Hash: 9a60b312f76118d8cd816a1a4a11205584d044c9dbebafe54e24eec035fa3e1b
Instruction Fuzzy Hash: D4916172A09A41C8DB50EF26D8903ADB3A6FB44B98F954232EE5D47B99DF39E444C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C16F88 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,0000000F,?,?,0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C1703D
memmove.MSVCRT(?,0000000F,?,?,0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C1704B
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C17083
memmove.MSVCRT(?,0000000F,?,?,0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C1708D
memmove.MSVCRT(?,0000000F,?,?,0000000F,00000000,?,00007FF746C24601,?,?,?,00007FF746C136BF), ref: 00007FF746C1709B

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memmove$??3@
String ID:
API String ID: 2321372689-0
Opcode ID: 648d95c8768f1c198ed66d0d780e6a4948cde1295dd9e0167cf436a41a78e7c7
Instruction ID: 3bec48e2114b829d40dc2f70c8ad0d51eb0f525951ad90028e3056ca98c240a3
Opcode Fuzzy Hash: 648d95c8768f1c198ed66d0d780e6a4948cde1295dd9e0167cf436a41a78e7c7
Instruction Fuzzy Hash: 4731E1A6B0868195DE54FB26AD042FBE352FB04BE4F844631DF6D4BB81DE3CE0928354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2155C Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C11B8C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C11C58

memset.MSVCRT ref: 00007FF746C215D9
GetOpenFileNameW.COMDLG32 ref: 00007FF746C2161B
wcslen.MSVCRT ref: 00007FF746C2162F
wcslen.MSVCRT ref: 00007FF746C21686
SetWindowTextW.USER32 ref: 00007FF746C216A3

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: wcslen$??3@FileNameOpenTextWindowmemset
String ID:
API String ID: 4150219074-0
Opcode ID: 1ac89aa1f044eb0e74c82c7f90cabd8c9ee570b4f552b0a0ccd67c1530cffe10
Instruction ID: f4f2372cc1a0fcd9730ef6d81b4d6d01c6db1e8ee5242500f0d093bbe36f2c02
Opcode Fuzzy Hash: 1ac89aa1f044eb0e74c82c7f90cabd8c9ee570b4f552b0a0ccd67c1530cffe10
Instruction Fuzzy Hash: 9F415873A05A40C9DB50EF34D8902EDB3A1FB58748B811636EB4E93B98DF39D469C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C206A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF746C206E6
OpenProcessToken.ADVAPI32 ref: 00007FF746C20706
DuplicateTokenEx.ADVAPI32 ref: 00007FF746C2072F
CloseHandle.KERNEL32 ref: 00007FF746C20741
CloseHandle.KERNEL32 ref: 00007FF746C20754

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: CloseHandleOpenProcessToken$Duplicate
String ID:
API String ID: 3520293429-0
Opcode ID: 6b0578e874e3aa85afb371ccc1805fcbb59dcd0c25f1d5589de596491d331caa
Instruction ID: c8907c7f163d48c5e896dc14761aa01649ce4766da3d3a954912c3379cccedcf
Opcode Fuzzy Hash: 6b0578e874e3aa85afb371ccc1805fcbb59dcd0c25f1d5589de596491d331caa
Instruction Fuzzy Hash: 2821A162B1C781C2F650FB16BC50967E392BB88BA0F881235ED5E57794CE3CE481C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13108 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF746C13156
VerSetConditionMask.KERNEL32 ref: 00007FF746C13171
VerSetConditionMask.KERNEL32 ref: 00007FF746C13181
VerSetConditionMask.KERNEL32 ref: 00007FF746C13191
VerifyVersionInfoW.KERNEL32 ref: 00007FF746C131AF

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: aa6da5fe0678fdf6d97ab75461c8f2d9a2550bcc5cfad8a5b2030603fb3eabce
Instruction ID: 2645ec70e29d059d75a23ae534f7c0221d4a4cab84d7b618e250eb7c73a7fdff
Opcode Fuzzy Hash: aa6da5fe0678fdf6d97ab75461c8f2d9a2550bcc5cfad8a5b2030603fb3eabce
Instruction Fuzzy Hash: A2118C77A08601CAE720EF21E844BAAB7A1FB8C758F415235EE4E57754EB38E149CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E0FC Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FF746C1E130
MulDiv.KERNEL32 ref: 00007FF746C1E145
MulDiv.KERNEL32 ref: 00007FF746C1E160
MulDiv.KERNEL32 ref: 00007FF746C1E174
DrawIconEx.USER32 ref: 00007FF746C1E1B1

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: DrawIcon
String ID:
API String ID: 3753536421-0
Opcode ID: b75dd67cbd8986ecfbb5c76384b4ede3d0c90750b9153ba5845a9f1b7205ad1f
Instruction ID: e6e914fc071bd251c6d7be1ec7632814eab0c38d2da64b297947b65689da2995
Opcode Fuzzy Hash: b75dd67cbd8986ecfbb5c76384b4ede3d0c90750b9153ba5845a9f1b7205ad1f
Instruction Fuzzy Hash: 0421F936718690CBD324DF22E844A5AB7A2F78CF94F148129EE4953B18CF39E845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1D000 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF746C1D021
free.MSVCRT ref: 00007FF746C1D035
free.MSVCRT ref: 00007FF746C1D049
free.MSVCRT ref: 00007FF746C1D05D
free.MSVCRT ref: 00007FF746C1D071
free.MSVCRT ref: 00007FF746C1D085

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e9b519f86c9e4c74f939f3a014f080592d6e562bac41cff582214ad22bf88cb4
Instruction ID: 4f6bde3702f83d3df08962b04b5559ba6196a6e34ab26c87b1ea61e4cbab1c78
Opcode Fuzzy Hash: e9b519f86c9e4c74f939f3a014f080592d6e562bac41cff582214ad22bf88cb4
Instruction Fuzzy Hash: 3E115A57A0E682C0EB54FE60C4A137BE362DF85B68F581235D91E095C6CF3CF88293A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1E26C Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF746C1E285
MulDiv.KERNEL32 ref: 00007FF746C1E298
MulDiv.KERNEL32 ref: 00007FF746C1E2AC
MulDiv.KERNEL32 ref: 00007FF746C1E2C1
MulDiv.KERNEL32 ref: 00007FF746C1E2D6

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ClientRect
String ID:
API String ID: 846599473-0
Opcode ID: edb129873137f0ef47d75c3e35584650bc46503bfbcf9ac00efb918c0930a863
Instruction ID: 70f3206aa743bec58888ea21e53f0d3458201f21573cfa55bdb572f28c5917b7
Opcode Fuzzy Hash: edb129873137f0ef47d75c3e35584650bc46503bfbcf9ac00efb918c0930a863
Instruction Fuzzy Hash: CC019536A18681CBE314EF26E85061BB762E78CB90F548035DF9A53B64CE3DE895CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2BABC Relevance: 7.5, APIs: 5, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAD8
HeapAlloc.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAEA
InitializeSListHead.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BAFB
GetProcessHeap.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB0B
HeapFree.KERNEL32(?,?,00000000,00007FF746C2B9FF,?,?,00000000,00007FF746C2BB8E,?,?,00000000,00007FF746C22B8D), ref: 00007FF746C2BB19

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: Heap$Process$AllocFreeHeadInitializeList
String ID:
API String ID: 927271182-0
Opcode ID: c5f17a7a957280a77a01a540216e03dccd3f140f3ae22e3bbe91e5ed3e9e52a3
Instruction ID: 2002be2e60fd021b9a293237c2dd94b6d31e6bda59f451757c0a1db02d82bc66
Opcode Fuzzy Hash: c5f17a7a957280a77a01a540216e03dccd3f140f3ae22e3bbe91e5ed3e9e52a3
Instruction Fuzzy Hash: F401F631E09A42C6FB44FB26E94423AE3A2BF4CB88F844438CD0D12765EF3DE495C220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C21284 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF746C212DF
SetTokenInformation.ADVAPI32 ref: 00007FF746C2130F
FreeSid.ADVAPI32 ref: 00007FF746C21321

Strings

, xrefs: 00007FF746C212FB

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: AllocateFreeInformationInitializeToken
String ID:
API String ID: 2127330248-3916222277
Opcode ID: 52d6ffd63ef4dc1904d3bd7227fd23bf5070f9a19c151ec77f9c2b86d68be125
Instruction ID: 774e8e652f695cfab1e385f87333351b2310aea47797838390ea534c362d805f
Opcode Fuzzy Hash: 52d6ffd63ef4dc1904d3bd7227fd23bf5070f9a19c151ec77f9c2b86d68be125
Instruction Fuzzy Hash: 6F115C32A18781C7F750EB15E89436AB3A1FB88795F500134DA8C47A54CF3DE448CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C27DD4 Relevance: 6.4, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C27E57
_CxxThrowException.MSVCRT ref: 00007FF746C27E76
_CxxThrowException.MSVCRT ref: 00007FF746C27E95
_CxxThrowException.MSVCRT ref: 00007FF746C27EB4
_CxxThrowException.MSVCRT ref: 00007FF746C27ED3

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: c5bd581909aa49c6d013a811113362d8e85978c7023e0de04676e6effc5c1048
Instruction ID: a479644ff00170a6f3175574c12a1521ec8ae03aaf1e3dbc4631b867d43b74cb
Opcode Fuzzy Hash: c5bd581909aa49c6d013a811113362d8e85978c7023e0de04676e6effc5c1048
Instruction Fuzzy Hash: FF51C372E1C942C1DB24FB28C89407AE362FB84B84FD45132EA5D47AA8DE3DF945C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C27CCC Relevance: 6.3, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C27D52
_CxxThrowException.MSVCRT ref: 00007FF746C27D71
_CxxThrowException.MSVCRT ref: 00007FF746C27D90
_CxxThrowException.MSVCRT ref: 00007FF746C27DAF
_CxxThrowException.MSVCRT ref: 00007FF746C27DCE

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: d39db556d8453bea1a6c4059d2d61e6df346d120cd730aa342402e39c7d8374d
Instruction ID: e178cff3c5966e762526cc4812e559e94cc02e454dad077bbf866be5ef272e30
Opcode Fuzzy Hash: d39db556d8453bea1a6c4059d2d61e6df346d120cd730aa342402e39c7d8374d
Instruction Fuzzy Hash: C821B1A2E6C482C2DA24F724CC694B7D322BB94744FD45032E58E46DBADE7DF604CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C16878 Relevance: 6.2, APIs: 4, Instructions: 163COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF746C16909
memcmp.MSVCRT ref: 00007FF746C1695F
memcmp.MSVCRT ref: 00007FF746C16A24
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16A8C

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memcmp$??3@
String ID:
API String ID: 3834356630-0
Opcode ID: d9cd7e06791bb6cbd55d13bcca279f6ebc60465a29bb1784dde8bcc81cd6981d
Instruction ID: 221a9163d643c9019115647ad49e97a2f0e0c1626849ef4305484ff9be029196
Opcode Fuzzy Hash: d9cd7e06791bb6cbd55d13bcca279f6ebc60465a29bb1784dde8bcc81cd6981d
Instruction Fuzzy Hash: 4461ACA270CA91C2EB10FB16E8541AAF7A0F744BD4F908535EE9D43B95CF38E8918B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1663C Relevance: 6.2, APIs: 4, Instructions: 163COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF746C166CD
memcmp.MSVCRT ref: 00007FF746C16723
memcmp.MSVCRT ref: 00007FF746C167E8
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C16850

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: memcmp$??3@
String ID:
API String ID: 3834356630-0
Opcode ID: 06b41a543ea792a87a720ee07ed76468a19b9074804891164bd48fe6edb7de86
Instruction ID: d29e70607d14ac4bf146fc93728dfb981885a125403854c7df01506e408560fb
Opcode Fuzzy Hash: 06b41a543ea792a87a720ee07ed76468a19b9074804891164bd48fe6edb7de86
Instruction Fuzzy Hash: 5061B1A271CA81C1EB10FB1AE8441AAF760F744BD4F914936DE9D87B95CF38E891CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C153F4 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C1548C
??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C154B2
memmove.MSVCRT ref: 00007FF746C15508
memmove.MSVCRT ref: 00007FF746C15538

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@memmove
String ID:
API String ID: 2100761966-0
Opcode ID: ba75c73015c2242ca02630a1227ebf392c1910618a86e2b7c65ab1b8f1dd71d1
Instruction ID: aa79ac4073af679da01f875a7716ebba29c971d723eab423f72912ed2733afbd
Opcode Fuzzy Hash: ba75c73015c2242ca02630a1227ebf392c1910618a86e2b7c65ab1b8f1dd71d1
Instruction Fuzzy Hash: DC41B1A2718A86D0DA10FA66D8444AEE721EB44BE4BD58732EE7D137D5DE3CE542C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1C9C8 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C255C0: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2562E

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CA3F
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CA84
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CAC9
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1CB2E

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 1efd99ae2a1f6f83cd32b3c0ad539fc3babb16f85c85d18d875b272a7239db87
Instruction ID: 6b020f0c75be36cd0c48917dc9b50be21fceaa3fc155003dadd2a313db2cf5c2
Opcode Fuzzy Hash: 1efd99ae2a1f6f83cd32b3c0ad539fc3babb16f85c85d18d875b272a7239db87
Instruction Fuzzy Hash: BD417FE3B19A8486EF15EE69C4583BDE352EB04FA8F944735DA2C0A5C9CF6CE4848340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C216DC Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C11B8C: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C11C58

DragQueryFileW.SHELL32 ref: 00007FF746C2176A
GetFileAttributesW.KERNEL32 ref: 00007FF746C217B3
SetWindowTextW.USER32 ref: 00007FF746C217E6
DragFinish.SHELL32 ref: 00007FF746C217EF

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: DragFile$??3@AttributesFinishQueryTextWindow
String ID:
API String ID: 4104282394-0
Opcode ID: 2e6ec1531e7b2b134043bcd7f6964987e66fc1a7ab54dd98b67d4543b5d7bda6
Instruction ID: f3c0ccfed04f92f5d6ca31c860f00677fc885c571a25523a24cea71aa2da04ec
Opcode Fuzzy Hash: 2e6ec1531e7b2b134043bcd7f6964987e66fc1a7ab54dd98b67d4543b5d7bda6
Instruction Fuzzy Hash: 61417873F14A01C9FB00EFA5D8401EDABB1FB48B68B842621CE1D63A58DF38E495C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C231FC Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,00007FF746C142A7), ref: 00007FF746C23229
??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C2326C
??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C23291
memmove.MSVCRT(?,?,?,00007FF746C142A7), ref: 00007FF746C232A3

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@memmove
String ID:
API String ID: 2100761966-0
Opcode ID: 278f3bdfa1897d4b16f7251da220594d6b082aaf129ef4f8b602eaf1309a1cbd
Instruction ID: 11c6bb8ad9e8e7f6a803085b686dfe3d5fc6d6861a44df8633b2c6f950935c37
Opcode Fuzzy Hash: 278f3bdfa1897d4b16f7251da220594d6b082aaf129ef4f8b602eaf1309a1cbd
Instruction Fuzzy Hash: 8C2153B2B09742C5EA54FA5599883BAE392AB047B0F948735DE7D0B7C5DF38E4908390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C26A90 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C23C74: ??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C23CC3

_CxxThrowException.MSVCRT ref: 00007FF746C26B48

Strings

ios_base::badbit set, xrefs: 00007FF746C26AFF
ios_base::eofbit set, xrefs: 00007FF746C26B12
ios_base::failbit set, xrefs: 00007FF746C26B0B

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1774377356-1866435925
Opcode ID: 954ab00c0872f958f6b94581a2c82dc17374a96b0a4089f7698a07c097330970
Instruction ID: fdb65823526c1b3045fd552e93ad1f3a65f071839f5410d028ce00c98bbcfbca
Opcode Fuzzy Hash: 954ab00c0872f958f6b94581a2c82dc17374a96b0a4089f7698a07c097330970
Instruction Fuzzy Hash: F9114A22E0C64AD6EA14FB11E9513ABE3A2EB50784F944431EB4D47A96DF3CF0A5C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2DA7F Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C2DAA3
_CxxThrowException.MSVCRT ref: 00007FF746C2DACD
_CxxThrowException.MSVCRT ref: 00007FF746C2DAF7
??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2DB12

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow$??3@
String ID:
API String ID: 3542664073-0
Opcode ID: a05a22f7801d06489e72fa6e6593defd15cded4c0c66acd8f80039aee3f1b07c
Instruction ID: 27da6611125da253b2c16dfc55a2d0a1dd0468931dc73b3f27df4b513c376f77
Opcode Fuzzy Hash: a05a22f7801d06489e72fa6e6593defd15cded4c0c66acd8f80039aee3f1b07c
Instruction Fuzzy Hash: F4019EA5B18A40C9E72CFA33EC522FB9212ABC87C4F549035ED4D4B74ACE3AE4514740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C20A68 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF746C20A8F
OpenProcessToken.ADVAPI32 ref: 00007FF746C20AA2
GetTokenInformation.ADVAPI32 ref: 00007FF746C20ACA
CloseHandle.KERNEL32 ref: 00007FF746C20ADD

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 2e33c89952cf7888bce86606bd6e7b2846efb0896bc79ddb04d7444bba4bb13a
Instruction ID: 4ddc3e60fe6430de3b2c29272cb67049dc9a25713ca0ee10a14ac0b494f99454
Opcode Fuzzy Hash: 2e33c89952cf7888bce86606bd6e7b2846efb0896bc79ddb04d7444bba4bb13a
Instruction Fuzzy Hash: 60010031A1CA82C2E650EB55E85416BF361FB88BB4F800335EA7E567E4DF7CE4458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C24814 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C24879

Strings

ios_base::badbit set, xrefs: 00007FF746C24831
ios_base::eofbit set, xrefs: 00007FF746C24843
ios_base::failbit set, xrefs: 00007FF746C2483C

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 334f3284b288845d52a8fe73c20ed30447054c4d4cdc3af7eea5f9e2e1648425
Instruction ID: ea4e64583af3455fa3262c1cc3d234f13df23881f3f431e30222e06af57032e9
Opcode Fuzzy Hash: 334f3284b288845d52a8fe73c20ed30447054c4d4cdc3af7eea5f9e2e1648425
Instruction Fuzzy Hash: 89F08C62E6C68AD2EE14FB00DC415FBE362AB50748FD84032D95D869A5EE3CF546C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C20880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C20A68: GetCurrentProcess.KERNEL32 ref: 00007FF746C20A8F
Part of subcall function 00007FF746C20A68: OpenProcessToken.ADVAPI32 ref: 00007FF746C20AA2
Part of subcall function 00007FF746C20A68: GetTokenInformation.ADVAPI32 ref: 00007FF746C20ACA
Part of subcall function 00007FF746C20A68: CloseHandle.KERNEL32 ref: 00007FF746C20ADD

SetLastError.KERNEL32 ref: 00007FF746C20941
WTSFreeMemory.WTSAPI32 ref: 00007FF746C20951

Strings

winlogon.exe, xrefs: 00007FF746C20922

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ProcessToken$CloseCurrentErrorFreeHandleInformationLastMemoryOpen
String ID: winlogon.exe
API String ID: 976019093-961692650
Opcode ID: b698fafb74598fe6b3ed2514eb24a8b1a26def01634973643b80a3724e5eecfe
Instruction ID: 155bb02d726b987cf38de1e402907dd28362b48b35e37c165776bedc044ca750
Opcode Fuzzy Hash: b698fafb74598fe6b3ed2514eb24a8b1a26def01634973643b80a3724e5eecfe
Instruction Fuzzy Hash: 42315E62A1CA42C6E764FB11A85067BF3A2FB84794F940135EE9E46694DF3CE451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C13AA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C13B57

Part of subcall function 00007FF746C13CD0: memmove.MSVCRT(?,?,?,00007FF746C13BA3), ref: 00007FF746C13D14

Part of subcall function 00007FF746C25234: memmove.MSVCRT ref: 00007FF746C25293
Part of subcall function 00007FF746C25234: memmove.MSVCRT ref: 00007FF746C252DE
Part of subcall function 00007FF746C25234: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C25326
Part of subcall function 00007FF746C25234: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C2536E
Part of subcall function 00007FF746C25234: ??0exception@@QEAA@XZ.MSVCRT ref: 00007FF746C25384

_CxxThrowException.MSVCRT ref: 00007FF746C13BC0

Strings

cannot use operator[] with a string argument with , xrefs: 00007FF746C13B93

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@memmove$??0exception@@ExceptionThrow
String ID: cannot use operator[] with a string argument with
API String ID: 1968904278-2766135566
Opcode ID: cf340ddeb24b485392c000a638af18312fb7162d76051f6f57214fde3e2fddb2
Instruction ID: 62f5242f07dc3f9f26d7595b1bd7208cfe6c8d382d8e1a015011d69a3fbccc57
Opcode Fuzzy Hash: cf340ddeb24b485392c000a638af18312fb7162d76051f6f57214fde3e2fddb2
Instruction Fuzzy Hash: 5931CA72B08A85D5EB10FB75C8402EDE361EB45B98F844231DE5C177C5EE38E541C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C26EB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C26F56
_CxxThrowException.MSVCRT ref: 00007FF746C26FBB

Strings

cannot use key() for non-object iterators, xrefs: 00007FF746C26F89

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??3@ExceptionThrow
String ID: cannot use key() for non-object iterators
API String ID: 3349825565-3527383725
Opcode ID: d7c6d8a945acaadae2ee18e8a3bfcac72812e31f571dba0d89b2c93f6ee73e57
Instruction ID: 7d1d723efcc890ffc0137af849871e36b3e72ca7974b0328908565d232a6f00a
Opcode Fuzzy Hash: d7c6d8a945acaadae2ee18e8a3bfcac72812e31f571dba0d89b2c93f6ee73e57
Instruction Fuzzy Hash: B9215062B0C646C2EE24FB29D84036EE362EB457A4F904232DA6D037E9DE3CF545C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1C36C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C1C3CD
_CxxThrowException.MSVCRT ref: 00007FF746C1C42E

Strings

961c151d2e87f2686a955a9be24d316f1362bf21 3.4.0, xrefs: 00007FF746C1C3FC

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@ExceptionThrow
String ID: 961c151d2e87f2686a955a9be24d316f1362bf21 3.4.0
API String ID: 1774377356-857451449
Opcode ID: ad690f9cb74648ad21d05dba1eb70fb8d94e523119ccbf6031cac0145c20050c
Instruction ID: 92d847ca3182e817266ddb017dbe1417e2a19d93f837698ac9e37c6e4e6d8c6f
Opcode Fuzzy Hash: ad690f9cb74648ad21d05dba1eb70fb8d94e523119ccbf6031cac0145c20050c
Instruction Fuzzy Hash: 6E2179E284C502C1E265FA28D8A43FBD690AB45314FC44232E65E066E5CE2DF50ACB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1BBE4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C13398: GetSystemWindowsDirectoryW.KERNEL32 ref: 00007FF746C133B7
Part of subcall function 00007FF746C13398: GetSystemWindowsDirectoryW.KERNEL32 ref: 00007FF746C13401

Part of subcall function 00007FF746C24530: memmove.MSVCRT(?,?,?,?,?,00007FF746C13E76), ref: 00007FF746C24571

RegOpenKeyExW.ADVAPI32 ref: 00007FF746C1BC6D

Part of subcall function 00007FF746C1EB58: GetModuleHandleW.KERNEL32 ref: 00007FF746C1EBA1
Part of subcall function 00007FF746C1EB58: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF746C1EC9F

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell, xrefs: 00007FF746C1BC5F
\NSudo.exe, xrefs: 00007FF746C1BC42

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: DirectorySystemWindows$??3@HandleModuleOpenmemmove
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell$\NSudo.exe
API String ID: 2334327573-2634088638
Opcode ID: 7ed9c4ccc027b6bbaa15cddf4ad82d2703c7bd7ad0feff38c48f61fce12b10ce
Instruction ID: 1212f8e207c02d103d951450254318a18d7f2216406fb4d41ad4cd0bab005a11
Opcode Fuzzy Hash: 7ed9c4ccc027b6bbaa15cddf4ad82d2703c7bd7ad0feff38c48f61fce12b10ce
Instruction Fuzzy Hash: 61116A72608B01C6E710EF29E84025AB7A0FB44FA8F944224DBAD477A4DF38F553CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C1D0D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C1D149
??1exception@@UEAA@XZ.MSVCRT ref: 00007FF746C1D15D

Strings

ios_base::badbit set, xrefs: 00007FF746C1D12B

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??1exception@@ExceptionThrow
String ID: ios_base::badbit set
API String ID: 3741338126-3882152299
Opcode ID: 17ea093403f27721348a23bea168791ac41c1f5f1177cbb3fc7494a94feae6c9
Instruction ID: c5e169108d77ab877101847a3e1b342c37a4c1a2b1eb358ee643d029f22df11c
Opcode Fuzzy Hash: 17ea093403f27721348a23bea168791ac41c1f5f1177cbb3fc7494a94feae6c9
Instruction Fuzzy Hash: 2901C0B2E4DA06C1EE14FB15D8511BAE321EB41764F805232EA5E433E4DE3CE196C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C12E04 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C12E60
??2@YAPEAX_K@Z.MSVCRT ref: 00007FF746C12E88

Strings

string too long, xrefs: 00007FF746C12E08
vector<T> too long, xrefs: 00007FF746C12E1C

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ??2@
String ID: string too long$vector<T> too long
API String ID: 1033339047-107800493
Opcode ID: 3d0eab5613b6e88787e7f88d81f7c72ca03f3a52ff67aca2dca831e5e4794e44
Instruction ID: 1bde5fb2ee020a6a018b238201a1992b2a7f2c94bae7b23d2cd4c090aa55f1ad
Opcode Fuzzy Hash: 3d0eab5613b6e88787e7f88d81f7c72ca03f3a52ff67aca2dca831e5e4794e44
Instruction Fuzzy Hash: C7F09699E0A685D1ED1CF7A1DC552B593518F643B0ED00B31D67E0B7D1DE3CB1818751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C131D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746C13108: memset.MSVCRT ref: 00007FF746C13156
Part of subcall function 00007FF746C13108: VerSetConditionMask.KERNEL32 ref: 00007FF746C13171
Part of subcall function 00007FF746C13108: VerSetConditionMask.KERNEL32 ref: 00007FF746C13181
Part of subcall function 00007FF746C13108: VerSetConditionMask.KERNEL32 ref: 00007FF746C13191
Part of subcall function 00007FF746C13108: VerifyVersionInfoW.KERNEL32 ref: 00007FF746C131AF

GetModuleHandleW.KERNEL32 ref: 00007FF746C131F0
GetProcAddress.KERNEL32 ref: 00007FF746C13203

Strings

user32.dll, xrefs: 00007FF746C131E9

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ConditionMask$AddressHandleInfoModuleProcVerifyVersionmemset
String ID: user32.dll
API String ID: 3562192782-38312619
Opcode ID: d6c7061fb1625124ed92fa2aba4897b6f033d7c7d22c5b428d74ca7285767f04
Instruction ID: 25d24189ceb5f9af156d8f2fc1e144f1f58542ae89dc8863efe44f5c5a9082e5
Opcode Fuzzy Hash: d6c7061fb1625124ed92fa2aba4897b6f033d7c7d22c5b428d74ca7285767f04
Instruction Fuzzy Hash: 99E092A1F0E202C1FD08FB218C542B2D3416F4A700FE84534CC4D123D1DE3CB545CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF746C2CC30 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00007FF746C2CC4E
_CxxThrowException.MSVCRT ref: 00007FF746C2CC93
_CxxThrowException.MSVCRT ref: 00007FF746C2CCB7
_CxxThrowException.MSVCRT ref: 00007FF746C2CCDB

Memory Dump Source

Source File: 00000005.00000002.53632899503.00007FF746C11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF746C10000, based on PE: true

Associated: 00000005.00000002.53632871986.00007FF746C10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632942024.00007FF746C2E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632970037.00007FF746C3B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.53632995762.00007FF746C3D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff746c10000_adminpriv.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 356defb4f08a69ef1f481320a5c8d2d03bb7cf45a386bd29fa33be675b2da2aa
Instruction ID: 84e42715d6c091baf1837181a77d4d160113419c0697a16874998bd32a334107
Opcode Fuzzy Hash: 356defb4f08a69ef1f481320a5c8d2d03bb7cf45a386bd29fa33be675b2da2aa
Instruction Fuzzy Hash: 7A2165A6A18A80C9E768FE32DC511FBA311FB847D4F449535FE5D4B75ACE38E4418740

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report adminpriv.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: adminpriv.exePID: 2008, Parent PID: 5344

General

Chronological Activities

Disassembly

Analysis Process: adminpriv.exePID: 2008, Parent PID: 5344COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF746C19A08 Relevance: 58.5, APIs: 24, Strings: 9, Instructions: 763COMMON

Windows Analysis Report
adminpriv.exe

Function 00007FF746C19A08 Relevance: 58.5, APIs: 24, Strings: 9, Instructions: 763
COMMON

Function 00007FF746C21DCC Relevance: 42.5, APIs: 14, Strings: 10, Instructions: 455
windowCOMMON

Function 00007FF746C1F0D8 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 323
COMMON

Function 00007FF746C20B88 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272
COMMON

Function 00007FF746C1E1E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39
libraryloaderCOMMON

Function 00007FF746C2BB3C Relevance: 5.0, APIs: 4, Instructions: 36
memoryCOMMON

Function 00007FF746C21828 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 270
windowCOMMON

Function 00007FF746C2B8E4 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57
libraryloaderCOMMON

Function 00007FF746C22754 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272
COMMON

Function 00007FF746C13294 Relevance: 10.6, APIs: 7, Instructions: 59
windowCOMMON

Function 00007FF746C1E020 Relevance: 7.6, APIs: 5, Instructions: 54
threadCOMMON

Function 00007FF746C16E64 Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Function 00007FF746C21020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 80
COMMON

Function 00007FF746C1E3B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Function 00007FF746C1E540 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON