Edit tour

Windows Analysis Report
elevation_service.exe

Overview

General Information

Sample name:	elevation_service.exe
Analysis ID:	1428994
MD5:	c93c02a0adb87cce4c3f1eded22889d9
SHA1:	5e0eed96333f4d1be22ceec37a3f98b095b50b93
SHA256:	6012fd82669bfd308bd6ac1c2b1b14821cc20c68881c496e838654b618199791
Infos:

Detection

Score:	18
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Sigma detected: Suspicious New Service Creation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Analysis Advice

Initial sample is implementing a service and should be registered / started as service

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

cmd.exe (PID: 6336 cmdline: cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6504 cmdline: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 6748 cmdline: cmd /c sc start OZgQJ >> C:\servicestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6940 cmdline: sc start OZgQJ MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

elevation_service.exe (PID: 7008 cmdline: C:\Users\user\Desktop\elevation_service.exe MD5: C93C02A0ADB87CCE4C3F1EDED22889D9)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , CommandLine: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6336, ParentProcessName: cmd.exe, ProcessCommandLine: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , ProcessId: 6504, ProcessName: sc.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , CommandLine: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6336, ParentProcessName: cmd.exe, ProcessCommandLine: sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" , ProcessId: 6504, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: elevation_service.exe

Static PE information: certificate valid

Source: elevation_service.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdbOGP source: elevation_service.exe

Source: elevation_service.exe	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: elevation_service.exe	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith

Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234F3070	6_2_00007FF7234F3070
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D4494	6_2_00007FF7234D4494
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D408C	6_2_00007FF7234D408C
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234FC88C	6_2_00007FF7234FC88C
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343CC28	6_2_00007FF72343CC28
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343A820	6_2_00007FF72343A820
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D7050	6_2_00007FF7234D7050
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343BC40	6_2_00007FF72343BC40
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234338E0	6_2_00007FF7234338E0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234B2110	6_2_00007FF7234B2110
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723433D10	6_2_00007FF723433D10
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723469510	6_2_00007FF723469510
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343B900	6_2_00007FF72343B900
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D24B0	6_2_00007FF7234D24B0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D489C	6_2_00007FF7234D489C
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343BB72	6_2_00007FF72343BB72
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723433B70	6_2_00007FF723433B70
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723431760	6_2_00007FF723431760
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234F3358	6_2_00007FF7234F3358
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723433780	6_2_00007FF723433780
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234F3750	6_2_00007FF7234F3750
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723432FE0	6_2_00007FF723432FE0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D2FA0	6_2_00007FF7234D2FA0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D4290	6_2_00007FF7234D4290
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234FEA20	6_2_00007FF7234FEA20
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343CE50	6_2_00007FF72343CE50
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D1F00	6_2_00007FF7234D1F00
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D4AA0	6_2_00007FF7234D4AA0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D4698	6_2_00007FF7234D4698
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343AEC0	6_2_00007FF72343AEC0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343DEC0	6_2_00007FF72343DEC0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF72343A560	6_2_00007FF72343A560
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF723431D60	6_2_00007FF723431D60
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234D3538	6_2_00007FF7234D3538
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234DF1DC	6_2_00007FF7234DF1DC
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234359E0	6_2_00007FF7234359E0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7235145F0	6_2_00007FF7235145F0
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234325D0	6_2_00007FF7234325D0

Source: C:\Users\user\Desktop\elevation_service.exe

Code function: String function: 00007FF72351350C appears 71 times

Source: elevation_service.exe

Static PE information: Number of sections : 11 > 10

Source: elevation_service.exe

Binary or memory string: OriginalFilename vs elevation_service.exe

Source: classification engine

Classification label: clean18.winEXE@9/2@0/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: elevation_service.exe

String found in binary or memory: partition_alloc/address_space

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc start OZgQJ >> C:\servicestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start OZgQJ
Source: unknown	Process created: C:\Users\user\Desktop\elevation_service.exe C:\Users\user\Desktop\elevation_service.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start OZgQJ	Jump to behavior

Source: C:\Users\user\Desktop\elevation_service.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\elevation_service.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: elevation_service.exe

Static PE information: certificate valid

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: elevation_service.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: elevation_service.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: elevation_service.exe

Static file information: File size 1838024 > 1048576

Source: elevation_service.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x15c800

Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: elevation_service.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: elevation_service.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: elevation_service.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdbOGP source: elevation_service.exe

Source: elevation_service.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: elevation_service.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: elevation_service.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: elevation_service.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: elevation_service.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: elevation_service.exe	Static PE information: section name: .gxfg
Source: elevation_service.exe	Static PE information: section name: .retplne
Source: elevation_service.exe	Static PE information: section name: LZMADEC
Source: elevation_service.exe	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"

Source: C:\Users\user\Desktop\elevation_service.exe

API coverage: 9.1 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\elevation_service.exe

Code function: 6_2_00007FF7234E1D9C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00007FF7234E1D9C

Source: C:\Users\user\Desktop\elevation_service.exe

Code function: 6_2_00007FF723487204 _Init_thread_header,GetProcessHeap,_Init_thread_header,

6_2_00007FF723487204

Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234CE438 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		6_2_00007FF7234CE438
Source: C:\Users\user\Desktop\elevation_service.exe	Code function: 6_2_00007FF7234E1D9C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_00007FF7234E1D9C

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start OZgQJ			Jump to behavior

Source: C:\Users\user\Desktop\elevation_service.exe

Code function: 6_2_00007FF723510928 IsValidSid,GetSecurityDescriptorDacl,SetSecurityDescriptorDacl,

6_2_00007FF723510928

Source: C:\Users\user\Desktop\elevation_service.exe

Code function: 6_2_00007FF7234CE6E4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00007FF7234CE6E4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
elevation_service.exe	0%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	elevation_service.exe	false		high
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	elevation_service.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428994
Start date and time:	2024-04-20 01:00:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run as Windows Service
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	elevation_service.exe
Detection:	CLEAN
Classification:	clean18.winEXE@9/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: elevation_service.exe

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	28
Entropy (8bit):	3.678439190827718
Encrypted:	false
SSDEEP:	3:4A4AnXjzSv:4HAnXjg
MD5:	A8F4D690C5BDE96AD275C7D4ABE0E3D3
SHA1:	7C62C96EFD2CA4F3C3EBF0B24C9B5B4C04A4570A
SHA-256:	596CCC911C1772735AAC6A6B756A76D3D55BCECD006B980CF147090B2243FA7B
SHA-512:	A875EBE3C5CDF222FF9D08576F4D996AF827A1C86B3E758CE23F6B33530D512A82CE8E39E519837512080C6212A0A19B3385809BE5F5001C4E488DD79550B852
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	[SC] CreateService SUCCESS..

C:\servicestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	421
Entropy (8bit):	3.5163190789234875
Encrypted:	false
SSDEEP:	6:lg3D/8FNFGgVKBRjGxVVLvH2s/u8qLLFmLaZnsHgm66//V+NmAY2fq:lgA0gV0qVbH2suZLQqOVKmAxq
MD5:	132410ECDC544F13BE0AF4FB776048B4
SHA1:	300DFF48BAAE41CD3A390F293AA9B7A8D30243F0
SHA-256:	9DE198DC66F1FD4A3B6D45B4531192F8C3B0EB774FE22771852CB8966F235DAB
SHA-512:	115A03AC2257A15AD340FCD7254343D55B52B2EC1FDB2C70FBEC26B960BD9E9D4DC25DACB06B4AF42B15795D664229BE47B08DEA534668EF5C6C29B7942D8D76
Malicious:	false
Reputation:	low
Preview:	..SERVICE_NAME: OZgQJ .. TYPE : 10 WIN32_OWN_PROCESS .. STATE : 2 START_PENDING .. (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN).. WIN32_EXIT_CODE : 0 (0x0).. SERVICE_EXIT_CODE : 0 (0x0).. CHECKPOINT : 0x0.. WAIT_HINT : 0x7d0.. PID : 7008.. FLAGS : ..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.553037080438572
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	elevation_service.exe
File size:	1'838'024 bytes
MD5:	c93c02a0adb87cce4c3f1eded22889d9
SHA1:	5e0eed96333f4d1be22ceec37a3f98b095b50b93
SHA256:	6012fd82669bfd308bd6ac1c2b1b14821cc20c68881c496e838654b618199791
SHA512:	96d6f4d0fecba2107adb92b477f47953da5e83044161e148ffd30d346f724b42733cb7a9322c982c418d5ce341e69576b55f73a2f2af5fc6724a0580a0547718
SSDEEP:	49152:SQt30B3uA8EYHCree1uksbraFShGJIWkm:zt32u51HCri+sK
TLSH:	3B856C03F6D941E8D06DC17887469136EA72BC4A0B34B6DF0690B7592E77AE46F3EB10
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."............................@..........................................`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14009e6d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66189CBA [Fri Apr 12 02:30:18 2024 UTC]
TLS Callbacks:	0x40052150, 0x1, 0x4009d880, 0x1, 0x4004ff00, 0x1, 0x4009ce30, 0x1, 0x4002aba0, 0x1, 0x40050f30, 0x1
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	719fd2c00189a1df5b9b1509b836eef3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/10/2023 20:51:55 16/10/2024 20:51:55
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	CE375D7A0A494CFB6B46B4398281FD9B
Thumbprint SHA-1:	FBFF636EBB3DE3A9FD6A55111F00B16D2FDFCF3D
Thumbprint SHA-256:	80CA15275739BEF2CAF6E5A4168EB0A07FEB15883E8A4F232D93B8EECFE0F0EA
Serial:	33000003A4CBE356B8CB7FE4270000000003A4

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBE7084F340h
dec eax
add esp, 28h
jmp 00007FBE7084F1AFh
int3
int3
dec eax
mov dword ptr [esp+20h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [000FC940h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007FBE7084F3A6h
dec eax
and dword ptr [ebp+18h], 00000000h
dec eax
lea ecx, dword ptr [ebp+18h]
call dword ptr [000F0362h]
dec eax
mov eax, dword ptr [ebp+18h]
dec eax
mov dword ptr [ebp+10h], eax
call dword ptr [000F025Ch]
mov eax, eax
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [000F0240h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+20h]
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [000F0488h]
mov eax, dword ptr [ebp+20h]
dec eax
lea ecx, dword ptr [ebp+10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+20h]
dec eax
xor eax, dword ptr [ebp+10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x18dc7a	0x3e4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18e060	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1cb000	0x1ac0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1b6000	0xce34	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1be400	0x27c8	.pdata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1cd000	0x1d40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18b6fc	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x18b5d0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15f300	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18e7a8	0x690	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18d1d8	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15c6cb	0x15c800	e497fd8e49cfb923b7dddd7e0bc32276	False	0.5182366391678622	data	6.573690533033309	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15e000	0x3c950	0x3ca00	291ae070e5ffa92a2db03b43847c6be2	False	0.4138611469072165	data	5.741133276985363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19b000	0x1a5a0	0xfe00	eefebc3a58495601ed00f3a88a102f4d	False	0.040354330708661415	data	1.5636633192940868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1b6000	0xce34	0xd000	04b7fe8216f9cd6e602337abebfda8a1	False	0.4969012920673077	data	6.03512135145638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x1c3000	0x2d40	0x2e00	61270f4a86c588579f07aa68b5f99016	False	0.4242527173913043	data	5.176887601209698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x1c6000	0xac	0x200	fd91265591b837c5463dc743a0369bfa	False	0.12890625	data	1.320312118710215
.tls	0x1c7000	0x1e1	0x200	efd1c6f0f93ab2416c643b6c95043890	False	0.07421875	data	0.3227799089149221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
LZMADEC	0x1c8000	0x11f1	0x1200	05e9eab8428a551a281ab278073669fa	False	0.3461371527777778	data	6.061983420666291	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
_RDATA	0x1ca000	0x15c	0x200	acbeea6d34cf7f3d9ebe1da9b644e51e	False	0.412109375	data	3.422089718840598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1cb000	0x1ac0	0x1c00	9eb247ad6a4192912c95b8dca06bae46	False	0.38936941964285715	data	4.5494994865267895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1cd000	0x1d40	0x1e00	0a934b4c3799fd766f5465a0f1aa3039	False	0.32981770833333335	GLS_BINARY_LSB_FIRST	5.4171080989850156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0x1cb100	0x10ac	data	English	United States	0.3844892221180881
RT_VERSION	0x1cc1b0	0x478	data	English	United States	0.40646853146853146
RT_MANIFEST	0x1cc628	0x497	XML 1.0 document, ASCII text, with very long lines (1061)	English	United States	0.5089361702127659

Imports

DLL	Import
dbghelp.dll	SymCleanup, SymFromAddr, SymGetLineFromAddr64, SymGetSearchPathW, SymInitialize, SymSetOptions, SymSetSearchPathW
OLEAUT32.dll	SysAllocStringByteLen, SysStringByteLen
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AssignProcessToJobObject, CloseHandle, CompareStringW, CopyFileW, CreateDirectoryW, CreateEventW, CreateFileA, CreateFileMappingW, CreateFileW, CreateHardLinkW, CreateProcessW, CreateThread, DecodePointer, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesExW, GetFileAttributesW, GetFileSizeEx, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalProcessorInformation, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessId, GetProductInfo, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadId, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetVersionExW, GetWindowsDirectoryW, HeapAlloc, HeapDestroy, HeapFree, HeapReAlloc, HeapSetInformation, HeapSize, InitOnceExecuteOnce, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeProcThreadAttributeList, InitializeSListHead, InitializeSRWLock, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetModuleInformation, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LocalFree, MapViewOfFile, MoveFileExW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, OutputDebugStringW, QueryFullProcessImageNameA, QueryFullProcessImageNameW, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, ReleaseSRWLockShared, RemoveDirectoryW, ResetEvent, ResumeThread, RtlCaptureContext, RtlCaptureStackBackTrace, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFilePointer, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetStdHandle, SetThreadInformation, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableSRW, SystemTimeToFileTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, TzSpecificLocalTimeToSystemTime, UnhandledExceptionFilter, UnmapViewOfFile, UpdateProcThreadAttribute, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, lstrcmpiW, lstrlenA
CRYPT32.dll	CryptProtectData, CryptUnprotectData
RPCRT4.dll	I_RpcOpenClientProcess
api-ms-win-core-winrt-string-l1-1-0.dll	WindowsCreateString, WindowsDeleteString, WindowsGetStringRawBuffer
ntdll.dll	NtClose, NtDeleteKey, NtOpenKeyEx, NtQueryValueKey, RtlFormatCurrentUserKeyPath, RtlFreeUnicodeString, RtlInitUnicodeString
api-ms-win-core-winrt-l1-1-0.dll	RoActivateInstance

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x14007fb20
OQS_CPU_has_extension	2	0x1400e45f0
OQS_KEM_alg_count	3	0x1400ea8c0
OQS_KEM_alg_identifier	4	0x1400ea8a0
OQS_KEM_alg_is_enabled	5	0x1400ea8d0
OQS_KEM_decaps	6	0x1400eadb0
OQS_KEM_encaps	7	0x1400ead80
OQS_KEM_free	8	0x1400eade0
OQS_KEM_keypair	9	0x1400ead60
OQS_KEM_kyber_768_decaps	10	0x1400eae70
OQS_KEM_kyber_768_encaps	11	0x1400eae60
OQS_KEM_kyber_768_keypair	12	0x1400eae50
OQS_KEM_new	13	0x1400eab20
OQS_MEM_cleanse	14	0x1400e47a0
OQS_MEM_insecure_free	15	0x1400e47e0
OQS_MEM_secure_bcmp	16	0x1400e4770
OQS_MEM_secure_free	17	0x1400e47b0
OQS_SIG_alg_count	18	0x1400eaea0
OQS_SIG_alg_identifier	19	0x1400eae80
OQS_SIG_alg_is_enabled	20	0x1400eaeb0
OQS_SIG_free	21	0x1400eade0
OQS_SIG_keypair	22	0x1400eb020
OQS_SIG_new	23	0x1400eaeb0
OQS_SIG_sign	24	0x1400eb050
OQS_SIG_verify	25	0x1400eb0a0
OQS_destroy	26	0x1400e0030
OQS_init	27	0x1400e4750
OQS_randombytes	28	0x1400e4970
OQS_randombytes_custom_algorithm	29	0x1400e4960
OQS_randombytes_nist_kat_init_256bit	30	0x1400e4990
OQS_randombytes_switch_algorithm	31	0x1400e4860
OQS_version	32	0x1400e4760

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	01:01:32
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:01:32
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:01:32
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"
Imagebase:	0xce0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:01:33
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc start OZgQJ >> C:\servicestart.log 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:01:33
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:01:33
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start OZgQJ
Imagebase:	0xce0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:01:33
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\elevation_service.exe
Imagebase:	0x7ff723430000
File size:	1'838'024 bytes
MD5 hash:	C93C02A0ADB87CCE4C3F1EDED22889D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.3%
Total number of Nodes:	811
Total number of Limit Nodes:	44

Executed Functions

Function 00007FF7234F0BFC Relevance: 10.6, APIs: 7, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF7234F0C0B
FlsGetValue.KERNEL32 ref: 00007FF7234F0C20
FlsSetValue.KERNEL32 ref: 00007FF7234F0C41
FlsSetValue.KERNEL32 ref: 00007FF7234F0C6E
FlsSetValue.KERNEL32 ref: 00007FF7234F0C7F
FlsSetValue.KERNEL32 ref: 00007FF7234F0C90
SetLastError.KERNEL32 ref: 00007FF7234F0CAB

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1eb6c5f04907fdfc1cde27baf1d5b0d84ab5507e669d3bada658521548b50840
Instruction ID: f954000a8537cdf09049a297f19a89bfaa49685dfc790a42ec45cafe3091b128
Opcode Fuzzy Hash: 1eb6c5f04907fdfc1cde27baf1d5b0d84ab5507e669d3bada658521548b50840
Instruction Fuzzy Hash: 3F116220B0968241F6D8B3325D51139D152DF947B4FD847F5D83EA76D6EE2CB4025A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234E6DB0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00007FF7234BB959,?,00007FF7234BB959,?,00007FF7234BB959,00007FF7234BB959,00007FF7234BB959,00000000,00007FF7234E71C3,?), ref: 00007FF7234E6ECC
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF7234BB959,?,00007FF7234BB959,?,00007FF7234BB959,00007FF7234BB959,00007FF7234BB959,00000000,00007FF7234E71C3,?), ref: 00007FF7234E6F57

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e293c9004bf7ff57fad9e59ff28d13d191e1bb8a1737dd51e63648b3adfaa3aa
Instruction ID: 14d19b550166e5e3b0d4855b167cd24eec266544727eb25436e8a2c9964af18a
Opcode Fuzzy Hash: e293c9004bf7ff57fad9e59ff28d13d191e1bb8a1737dd51e63648b3adfaa3aa
Instruction Fuzzy Hash: 0C91B522E0869285F790AF659C4067DBBA1FB44B98F9442F9DE0EB6695CE3CD4418B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234DC958 Relevance: 4.5, APIs: 3, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00000003,00007FF7234DCA50), ref: 00007FF7234DC969
TerminateProcess.KERNEL32(?,?,00000003,00007FF7234DCA50), ref: 00007FF7234DC974
ExitProcess.KERNEL32 ref: 00007FF7234DC983

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bb7654733cbd4997d278771bdb0f3aefc2d80a37ada38ca149b96614f1493667
Instruction ID: 16d3e1aec78b8fa762584f4d143f78e18157d57e3c424e6436d03d1a61ee5be0
Opcode Fuzzy Hash: bb7654733cbd4997d278771bdb0f3aefc2d80a37ada38ca149b96614f1493667
Instruction Fuzzy Hash: F2D01710B0964642EAD47B316C851388212EF49B01F8418F8D84F62397CD2CA80D8E60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F58E4 Relevance: 3.1, APIs: 2, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__free_lconv_mon.LIBCMT ref: 00007FF7234F5941
__free_lconv_num.LIBCMT ref: 00007FF7234F5963

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID:
API String ID: 2148069796-0
Opcode ID: 242eabf05d8a576705f5a32202e0a18e80847796e05fe206584f0ec394696ede
Instruction ID: 7ec4ea7d6a782f8d90a8bb49e8155a0daee9f7dbf0da1df4d5ef5dbfd1984d5c
Opcode Fuzzy Hash: 242eabf05d8a576705f5a32202e0a18e80847796e05fe206584f0ec394696ede
Instruction Fuzzy Hash: 0E410631A1954284EFA4BE21C8503BDA360EF44B99FC840F1DA4EA7685DF6CD4918F71

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234E7650 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF7234E7703
GetLastError.KERNEL32 ref: 00007FF7234E771F

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: f814523470a0d7f586324aaf7e90586d02274ccfeee9025a8526b034edccc08c
Instruction ID: 786c35b3a494dd018ba676f6a1dddb4f0afef51aab43e32b5d7f0d1daf73460a
Opcode Fuzzy Hash: f814523470a0d7f586324aaf7e90586d02274ccfeee9025a8526b034edccc08c
Instruction Fuzzy Hash: DA310572A08B818AD790AF29EC406A8BBA0FB18790F8445B2DB4D93755DF3CD451CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234DC850 Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7234DC9B3

Part of subcall function 00007FF7234DC8C4: GetModuleHandleExW.KERNEL32 ref: 00007FF7234DC8E9
Part of subcall function 00007FF7234DC8C4: GetProcAddress.KERNEL32 ref: 00007FF7234DC8FF
Part of subcall function 00007FF7234DC8C4: FreeLibrary.KERNEL32 ref: 00007FF7234DC926

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7dc6214cf76642df9874e9c32976de5671152be8c15ba20ce1a61a8957e15c35
Instruction ID: 3c0b1da524f9b0361230ba7f2054c84384d1d132a31c51d35c47bb27cb9226ee
Opcode Fuzzy Hash: 7dc6214cf76642df9874e9c32976de5671152be8c15ba20ce1a61a8957e15c35
Instruction Fuzzy Hash: 6F21B472A0474589EBA4EF68C8402BC73A0EB04318F8406B6D75E66AC5DF38DA85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234DC844 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7234DC9B3

Part of subcall function 00007FF7234DC8C4: GetModuleHandleExW.KERNEL32 ref: 00007FF7234DC8E9
Part of subcall function 00007FF7234DC8C4: GetProcAddress.KERNEL32 ref: 00007FF7234DC8FF
Part of subcall function 00007FF7234DC8C4: FreeLibrary.KERNEL32 ref: 00007FF7234DC926

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7fc39ed27038240f85d560c0bda6f5e63b856e9fff77b3261ef04223b0c92d5c
Instruction ID: 4d89650874ccd4e40945934441f6e597fb8519639cdd16b0e167cdad4d65976a
Opcode Fuzzy Hash: 7fc39ed27038240f85d560c0bda6f5e63b856e9fff77b3261ef04223b0c92d5c
Instruction Fuzzy Hash: E521B272E04B4589EB90DF69D8402BC73A0E744718F9402B6D79E62AC4DF38CA85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234CCB00 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7234CCB30

Part of subcall function 00007FF7234CDB20: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7234CDB29

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 68ed8882d5edfcf14b17e99149a45bbb752b7e902727cb2e9188500c50629652
Instruction ID: a1d9fdeaa8cab559e8e006f0da9b8a60565dcf22a82fd6c647a079e971ae469e
Opcode Fuzzy Hash: 68ed8882d5edfcf14b17e99149a45bbb752b7e902727cb2e9188500c50629652
Instruction Fuzzy Hash: 37E0EC51EA910745F9E875A12C250B58040CF55371E9C1FF0DA3EE52D2BD1CF9928970

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7234FEA20 Relevance: 25.7, APIs: 9, Strings: 5, Instructions: 1227COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7234FEA6E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7234FF0DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7234FF250
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7234FF50E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7234FF72E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7234FF96B
memcpy_s.LIBCPMT ref: 00007FF7234FFA46
memcpy_s.LIBCPMT ref: 00007FF7234FFAF1
memcpy_s.LIBCPMT ref: 00007FF7234FFBC0

Strings

1#QNAN, xrefs: 00007FF7234FEB87
MZx, xrefs: 00007FF7234FF0FB, 00007FF7234FF160, 00007FF7234FF51E, 00007FF7234FF5E1, 00007FF7234FF64D, 00007FF7234FF978
1#INF, xrefs: 00007FF7234FEB97
1#IND, xrefs: 00007FF7234FEB5B
1#SNAN, xrefs: 00007FF7234FEB7E

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$MZx
API String ID: 808467561-2638907429
Opcode ID: 8a198bf39f59e673d209bf8f466c87d6a2b1b7e24f491002ce79f414d25fa38b
Instruction ID: fdca7900e1d42f0b3bb3261533c4e00f9204dfd5b6c4d70eee23e14dc67bd79e
Opcode Fuzzy Hash: 8a198bf39f59e673d209bf8f466c87d6a2b1b7e24f491002ce79f414d25fa38b
Instruction Fuzzy Hash: E7B2E972E183824BE7A49F64D8407FDB7A1FB44784F9852B5DA0DA7A84DB38E940CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234E1D9C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7234E1E15
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7234E1E2D
RtlVirtualUnwind.KERNEL32 ref: 00007FF7234E1E68
IsDebuggerPresent.KERNEL32 ref: 00007FF7234E1EA1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7234E1EAB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7234E1EB6

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2c3b0dbe735012ddc069fb0fa4785fa202aa3f4e786b679c332b2d6e9ef35c8a
Instruction ID: ef72ebe72e0616539bff5e0a22eafb96738d12fd5e62294a0a6f694c099b3a6e
Opcode Fuzzy Hash: 2c3b0dbe735012ddc069fb0fa4785fa202aa3f4e786b679c332b2d6e9ef35c8a
Instruction Fuzzy Hash: A7316132608B8185D7A4DF35EC402BEB3A1FB88794F940576EA8D53B98DF38D5468B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723510928 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF723457804,?,?,?,?), ref: 00007FF72351096A
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF723510AA9

Part of subcall function 00007FF723511E64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF723511E88

SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF723510AFD

Strings

bad_array_new_length was thrown in -fno-exceptions mode, xrefs: 00007FF72351092C

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: DescriptorSecurity$Dacl$InitializeValid
String ID: bad_array_new_length was thrown in -fno-exceptions mode
API String ID: 1195780802-4284143231
Opcode ID: cb232f5f931baf869900773801cafadbfaf8e9692a20e768bb7ea47f3ed70338
Instruction ID: 49e6b5e021b28f88625529d34b45808c45db47395a4ddb4eebd461f8537181a4
Opcode Fuzzy Hash: cb232f5f931baf869900773801cafadbfaf8e9692a20e768bb7ea47f3ed70338
Instruction Fuzzy Hash: 0661D72161864241FA90BB339C543BEE790EF44B84F8455B1DE8E67792DF3CE5468B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D7050 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7234D70B6
memcpy_s.LIBCPMT ref: 00007FF7234D70E1

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 0d98fb91389c02328d3a0913376dc004a088788b517f31914714e7ff91d77395
Instruction ID: 517998a5b6b78b61a26793872a5a3674fc98e0b23ed63328a38dcec04e8b0957
Opcode Fuzzy Hash: 0d98fb91389c02328d3a0913376dc004a088788b517f31914714e7ff91d77395
Instruction Fuzzy Hash: 34C1F572B1828A87D7A5DF15A444A7EFB91F784B84F8481B5DB8A93B44DB3DE801CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723487204 Relevance: 4.5, APIs: 3, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00007FF723511B76), ref: 00007FF72348723E

Part of subcall function 00007FF7234CCCF8: EnterCriticalSection.KERNEL32(?,?,?,00007FF72348730F,?,?,?,?,00007FF723511B76), ref: 00007FF7234CCD08
Part of subcall function 00007FF7234CCCF8: LeaveCriticalSection.KERNEL32(?,?,?,00007FF72348730F,?,?,?,?,00007FF723511B76), ref: 00007FF7234CCD48

_Init_thread_header.LIBCMT ref: 00007FF723487230

Part of subcall function 00007FF7234CCC60: EnterCriticalSection.KERNEL32(?,?,?,00007FF7234872A5,?,?,?,?,00007FF723511B76), ref: 00007FF7234CCC70

_Init_thread_header.LIBCMT ref: 00007FF7234872A0

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_header$HeapLeaveProcess
String ID:
API String ID: 2205551594-0
Opcode ID: b4184ed66e2347d397cc9ffdf51da384e48ac9683ebb33544ff6834ffeb6d1d0
Instruction ID: 164914e9ae378269813172a9136cffed8accd33173d3a64fa6edf79d16cc8418
Opcode Fuzzy Hash: b4184ed66e2347d397cc9ffdf51da384e48ac9683ebb33544ff6834ffeb6d1d0
Instruction Fuzzy Hash: C631B430909A0B96EA80FB26ECD4674B360FB44B50FC006F1D52DA26B1DF3CAA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F3358 Relevance: 3.9, Strings: 3, Instructions: 195COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7234F34E2
-, xrefs: 00007FF7234F359B
e+000, xrefs: 00007FF7234F3465

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: abf6bd17ec0a979bdcd0cf94ea83f2732f7df918faf5c8b6a545d84ca76af6ad
Instruction ID: 24c76f27fe564eb5615db04500bb73e191ffaea84a71a9e9bb93d582e0342d17
Opcode Fuzzy Hash: abf6bd17ec0a979bdcd0cf94ea83f2732f7df918faf5c8b6a545d84ca76af6ad
Instruction Fuzzy Hash: 4C710332B187C586E7A1DF25E840769B791F784B98F8882B1DBAC97B85CF3DD4418B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234FC88C Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7234FCADB
RaiseException.KERNEL32 ref: 00007FF7234FCAEC

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 8c1c7361079fd0a654b9f88953bc81cc4cff654ab57b5e8b14e33f9f7f75494f
Instruction ID: 4ac04ce4a296f68b110fcf3b237bb169a0eac098cf1c04ea4ceb5f02b9f2f239
Opcode Fuzzy Hash: 8c1c7361079fd0a654b9f88953bc81cc4cff654ab57b5e8b14e33f9f7f75494f
Instruction Fuzzy Hash: 34B17E77A04B848BEB55CF29C84636C7BA0F744B48F5889A2DB5D937A4CB39D851CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723469510 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF7234698E5
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF7234698CA

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 0-1298883408
Opcode ID: 0456011ffb5641cb683eaceb7963187ceca6a595427a159558c6b79cc0a3a7be
Instruction ID: af284a04f1fb1e6673d14cb1a40afebb920503769eeb67fe58dd1893851216f5
Opcode Fuzzy Hash: 0456011ffb5641cb683eaceb7963187ceca6a595427a159558c6b79cc0a3a7be
Instruction Fuzzy Hash: 1EA16AA2B1C34282FFA8AF15DD04779A661EB11B94F8442F5CD6DA77D1CEACE1418F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234B2110 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

UUUUUUUU, xrefs: 00007FF7234B216B
33333333, xrefs: 00007FF7234B217E

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID: 33333333$UUUUUUUU
API String ID: 0-3483174168
Opcode ID: c85249206f9825f6dead4e6181094f2a55b5d0ff780fe394186cdd5a21b1e143
Instruction ID: e4d5f5b238a42b6d9b179cc6c4f76f27ca9b121fd2d5041fb07a9d58882b04e2
Opcode Fuzzy Hash: c85249206f9825f6dead4e6181094f2a55b5d0ff780fe394186cdd5a21b1e143
Instruction Fuzzy Hash: 5A313991F2A71E01FDA89B9A9C00778D243AB58FE0789D4B2DD4CEB788DD3CE4468211

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F3750 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7234F3A92

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 4adb16bf925c8cb7d083f306e19bcf85be6fba4943fe9f76eda318906cf2c28d
Instruction ID: 1467a1ebe27b4cf64ef5702642bb82cc1deb59eae6cb7d84389b270070b430f0
Opcode Fuzzy Hash: 4adb16bf925c8cb7d083f306e19bcf85be6fba4943fe9f76eda318906cf2c28d
Instruction Fuzzy Hash: 16A16B62B087C646EBA1DF2698007BDBB91EB50BC8F4881B1DE8D97785DE3DD501CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343DEC0 Relevance: 1.3, Instructions: 1269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1e13c95d6cd2d8f2921b9e83b013f5092bfbbb21e7cc2c2ef6f15e67356004
Instruction ID: cd188bdda1968ba9245d24ca1c93cc3317e981426dee06a0401f4e5f608699e1
Opcode Fuzzy Hash: cb1e13c95d6cd2d8f2921b9e83b013f5092bfbbb21e7cc2c2ef6f15e67356004
Instruction Fuzzy Hash: F2A2A5776287448F9358DF25A44405BBBA2F798248F869519FB83D3688EB7CEE01CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343AEC0 Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
Instruction ID: 336d569e4eb4cb3de903b2aaec70d2d600c9dd1570fd2102cf9155f45e79b791
Opcode Fuzzy Hash: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
Instruction Fuzzy Hash: FA324C770B46004BD31FCE2ED99158AB292F784AA2709F238FE57C7B54E67CEE158604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234359E0 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
Instruction ID: b5454a2c6ba8dd0bd81bb2fef919fc02165bdcd2b8e686789d944e96cb8b6377
Opcode Fuzzy Hash: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
Instruction Fuzzy Hash: C73267B6B90A6596DB048F16E94139D7B64F319BC8F898526DF8C93B54EB38E471C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234325D0 Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621dddc85820b6b9669c90c1ac098aea83f3a6e1c9f60fd3a8c13654824637f4
Instruction ID: 829da999f2fcaf211d360b176e053bf5ce3f674cc451e9d471cf2a60470bbc60
Opcode Fuzzy Hash: 621dddc85820b6b9669c90c1ac098aea83f3a6e1c9f60fd3a8c13654824637f4
Instruction Fuzzy Hash: DE226012D18FEA52E6235739D4031B66310EFB6BC8F10E717FED8B25A2DF75A9859200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723431D60 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d8db660dafa7654a1594341d234b86c4b903bc484b0369b76a9fc2ccc5b30d
Instruction ID: 4ea7cdc2790234e92791c474b201899d2c3bf908ad24153e8df722178dcca58d
Opcode Fuzzy Hash: c0d8db660dafa7654a1594341d234b86c4b903bc484b0369b76a9fc2ccc5b30d
Instruction Fuzzy Hash: 5C22A722D0CFCA51E6224B39D0065B57720BFB7294B10D32BFFC9B1472EB76B6919A11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D24B0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a1f84c944a43ec7034e24ef788ec24b22851b33b6c59e5867f0222ce6c1e63
Instruction ID: cfa90cf1713267512907263e2b72f41246126571a6f98fe45019751bb7dd12e6
Opcode Fuzzy Hash: 35a1f84c944a43ec7034e24ef788ec24b22851b33b6c59e5867f0222ce6c1e63
Instruction Fuzzy Hash: A6E10972A2860A85E7E5AA28C96477CA3A1EF45744F9442F1DE0DA72D5CF3DE841CF20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343BC40 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70818ee03da86575b51552e93f9f9405f489d013b880787e623c0ed1199ed084
Instruction ID: 483a3b0876ff6ef295591e1e41477b6682ecc7f8342485ca00877a2cbe2a6da7
Opcode Fuzzy Hash: 70818ee03da86575b51552e93f9f9405f489d013b880787e623c0ed1199ed084
Instruction Fuzzy Hash: 06D19C9BC28FD945F313633D58436A2E610AFFB5D9A20E343FDF471A62EB5072956220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D3538 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8e2936a924f80d323619c75ea48f8fce531cb7dfa5af78da1950a1cd8514c0
Instruction ID: 5df237cdebf1932d8684c54269b5be1d4eefa7fcb4e95177b4a428537cdf4a00
Opcode Fuzzy Hash: 3a8e2936a924f80d323619c75ea48f8fce531cb7dfa5af78da1950a1cd8514c0
Instruction Fuzzy Hash: 50D1C762A0864A85EBF8AB25881027DB7A0FB05B4CF9441F5DE0DA77D5CF39E841DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723431760 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
Instruction ID: d09f16879914dbd716c5130e85fd97274a8d3b0906c6ef1a7df3dc89aeb0a25b
Opcode Fuzzy Hash: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
Instruction Fuzzy Hash: 56F13E12D1CFC583E6615B399A012BAA320FFB5348F11E755EFD922961DF2CF2E59210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D1F00 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76475326ced42e69210d107821e0cb9b9c7968e2d2ef311a18faad1ee7a713e8
Instruction ID: 26e15d241035490a75c4f8392cd4be9c04ca955df5a836a1e799d33b2fca1e84
Opcode Fuzzy Hash: 76475326ced42e69210d107821e0cb9b9c7968e2d2ef311a18faad1ee7a713e8
Instruction Fuzzy Hash: 24B1E27261864985E7E4AF39D85023CBBA0EB49B48F9442F5DF4DA7399CF39D440CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D2FA0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5452c3364bb374ffb678229e79ca7795c6f8a551babffcf380cdc37145f2667
Instruction ID: c38e2ad92183c8cedb54aad5cf9f66ec8d006ad49c0dee0e20ef1c61b389ac72
Opcode Fuzzy Hash: a5452c3364bb374ffb678229e79ca7795c6f8a551babffcf380cdc37145f2667
Instruction Fuzzy Hash: 49B1607290878A85EBE59F29C85013CBBA0F745F4CFA841B5CA4EA7399CF79D441CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723432FE0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271cf5adf6b916b6d877014c4ede45c53ce2a1cbea0494bb3ac754d4433aaffe
Instruction ID: 4404298d3d47ed592507b6bf13bc6e799957129330b5b4dfc43cdfb9bb0652f6
Opcode Fuzzy Hash: 271cf5adf6b916b6d877014c4ede45c53ce2a1cbea0494bb3ac754d4433aaffe
Instruction Fuzzy Hash: 2CB16C22C0DB9141F78777350803274D6209FF2298FA0C7B2FDA9B29A6DF2DF6885520

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F3070 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8be65e3070807ce6df9804fae7cfe0167ca118186f98c66f8cc258e378f098
Instruction ID: 8e1423afb98ad4b29b0f813a5a5f86f1881ac0eff90900bb6bffa3326f3ebf70
Opcode Fuzzy Hash: 9d8be65e3070807ce6df9804fae7cfe0167ca118186f98c66f8cc258e378f098
Instruction Fuzzy Hash: 7481C472A0C78146E7F4EB19A94037ABA91FB457D8F9842B5DA8D93B89CF3DD4408F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343A560 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
Instruction ID: 42858ce704e87d82e7337dbb5c1b4504bf1351e8323591d66745dc42e29d66d4
Opcode Fuzzy Hash: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
Instruction Fuzzy Hash: A86107E6F50F9883DB548B9EA402B886760F719FC5F55511AEE2C67301EA3DE9A3C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343A820 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
Instruction ID: da7cff74ec7fdd3f23c44029e7e5cb4f6e3f0f44d058c844f84f206ffc1f1dbc
Opcode Fuzzy Hash: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
Instruction Fuzzy Hash: BA51BAF3B62B9485D7918FA9E444BC837A8F329F95F215115EB4C6B351DB328A62C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D4494 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a4a08224c1da5fbc08545c5ed7e9b08e0e2b13ccc67bde5cbb94c1b735d00b
Instruction ID: 69b0493763f0b0eb899d4945755abd014019abad1ced422f8013f7baa1e05646
Opcode Fuzzy Hash: 20a4a08224c1da5fbc08545c5ed7e9b08e0e2b13ccc67bde5cbb94c1b735d00b
Instruction Fuzzy Hash: BB51A336B1865582E7E89B28C454338B7A0EB44F58FE441B1DB4DA77A4CF3AE843CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D408C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b18807b63760938d676101e95c8ce6529bc3e91572776f4ae69aff04d05f04
Instruction ID: 3b2e022caa06f989a55b4d56b351990f99c5c17686ca52658d3ab5215eb2e302
Opcode Fuzzy Hash: a0b18807b63760938d676101e95c8ce6529bc3e91572776f4ae69aff04d05f04
Instruction Fuzzy Hash: 2051C936B1865986E7E89F19C84423C77A0EB54B98FA441B1CE4CA7794CF3AE853CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D489C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4071739b4a50b591e650b48c08923a9773e6339a732606896c9d48caff69d1
Instruction ID: 45eea1059579dd3b0585e9a5afb82986f89d0f5aaa807cd2d5bde4aa15b8f679
Opcode Fuzzy Hash: ef4071739b4a50b591e650b48c08923a9773e6339a732606896c9d48caff69d1
Instruction Fuzzy Hash: BF518136B1865986E7E89F29C444238B7A0EB45B58FA441F1CA4DA7794CF3AEC43CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D4290 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8af6fa293604918f25e7cffefb6f0905c2ce10f9423000e8698da6502497bbc
Instruction ID: b8db13a75b21482d650d5f2182054beba04a3abef3d0c6255cdeb88feffd93ef
Opcode Fuzzy Hash: b8af6fa293604918f25e7cffefb6f0905c2ce10f9423000e8698da6502497bbc
Instruction Fuzzy Hash: A051A736B1865585E7E89B29C44023CB7A1EB45B58FE441B1CE4CA7798CF3AE843CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D4AA0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef406b5b2ff97be2da686813bf6979fa11b7dc2b1f9ab3c685366571af783b5
Instruction ID: c078ea1fd96867cd7d018da1f878f1d643e590ba67eff814ea4adde797cee25f
Opcode Fuzzy Hash: eef406b5b2ff97be2da686813bf6979fa11b7dc2b1f9ab3c685366571af783b5
Instruction Fuzzy Hash: E4519332B1865981E7E89B29C444338B7A0EB55F58FE541B1CA4CA7799CF3AEC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234D4698 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3743b69b2de2fd2efcbba1575c94052dde561f7606befb3c66bd6493ac8f30
Instruction ID: cb76eb10fc28295fd9eec6a08e32bc95970c0409c71b0ced0a9da48769c10f88
Opcode Fuzzy Hash: 2b3743b69b2de2fd2efcbba1575c94052dde561f7606befb3c66bd6493ac8f30
Instruction Fuzzy Hash: 0351DA36B1869582E7E89B29C440238B7A0EB45F58FE441B1DE4DA7794CF3AEC43CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343B900 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583ba1ca20b186ab7342fed39f81f6f6a7e4898d011913bb4cfa333a4dff57f3
Instruction ID: 2b8855800b73ef5122bcfd0c545f2471edb728946f22aca15d5b6c3c2fc628d2
Opcode Fuzzy Hash: 583ba1ca20b186ab7342fed39f81f6f6a7e4898d011913bb4cfa333a4dff57f3
Instruction Fuzzy Hash: B441E5DAC29FB945E723A33A6D43286D9109EF7989550E307FCB439E65F701B4D13224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343CE50 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0234dbe2120e3913c780a322aec058b20794f89e6ef908f1cb649dff0a3dea63
Instruction ID: fbf5a439bd4308665dcea7def675b1eb9c85670bb77e60a73caafec4116fd5d0
Opcode Fuzzy Hash: 0234dbe2120e3913c780a322aec058b20794f89e6ef908f1cb649dff0a3dea63
Instruction Fuzzy Hash: DE417CA9D19F9A02FB13A3396803233D2109FF3698E42D71BFDB439DA9D716B6406214

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234DF1DC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84a363b9679fe9b95f6bd97690fd36c54302cabe73c9c7cc48991d68dffa133
Instruction ID: f62be41baf5eaacda46d07a98d9575f66bd0d677325e3d387e7832fad4faa754
Opcode Fuzzy Hash: e84a363b9679fe9b95f6bd97690fd36c54302cabe73c9c7cc48991d68dffa133
Instruction Fuzzy Hash: 6E41E462714B5541EF84DF2ADD14579A3A1F748FD4B89A172EE0DA7B58DE3CC4418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343CC28 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2229031b1c07c239dd9e8bd448475ede22a9e0fcbcde17418adb4dc2fe1573a4
Instruction ID: 9eaa3f2c7300de5d87b3bb5310a47d155dec67bfb39258ac14b72af3beb0801a
Opcode Fuzzy Hash: 2229031b1c07c239dd9e8bd448475ede22a9e0fcbcde17418adb4dc2fe1573a4
Instruction Fuzzy Hash: B14140A9D1EFA902EB03773A6C0332796109FF3648E42D71BFDB439EA5D706B6406214

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234338E0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6138ee6e6fa5df4f883c5c3ccc2415be052fbe3df4a4f7c0ffcdd3982bfaa12f
Instruction ID: e3c294aadb49c317f9564cce13b0b72af980d673da813fa05bc8884abde4d9a6
Opcode Fuzzy Hash: 6138ee6e6fa5df4f883c5c3ccc2415be052fbe3df4a4f7c0ffcdd3982bfaa12f
Instruction Fuzzy Hash: 5541052AE2CFD751F31393392403532E2109FF7595E81EB2FBCE8B1962AB6467416218

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7235145F0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45a63904b28fe0f60c4b084a47b9d1f33eaa8fedc0cc34629d77899c4fe9fa5
Instruction ID: 3bf9be9c8267a14ab856273b9fd48037647d37cb98e6f0e42f5713cae5d3cbc0
Opcode Fuzzy Hash: d45a63904b28fe0f60c4b084a47b9d1f33eaa8fedc0cc34629d77899c4fe9fa5
Instruction Fuzzy Hash: 713125B1E2860A4BF7C59B3EEC41724A1A0EB25708FC46179D86DE6A90DE3DF8419F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723433B70 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f27651be28768d86d97d85717e888da748761da23619e89767ca2a73802efdc
Instruction ID: 8a57fbe832844001c69014487e379dd16cb463b3c68a87c10e0c4e5d3bbeafcf
Opcode Fuzzy Hash: 3f27651be28768d86d97d85717e888da748761da23619e89767ca2a73802efdc
Instruction Fuzzy Hash: 1E31572AD2DFD751F313973E6407125D614AFF3285A90E31BB9A835822FB119380A304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723433D10 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac0df919a3fdeab4b0b5455f3e1bbe40559e36d6ef3c9d4005759d79898284d
Instruction ID: 1adc80e8659c4f62ed42adf45a7b1a30ebf678d702b30fe35c0d830e460d42d3
Opcode Fuzzy Hash: 0ac0df919a3fdeab4b0b5455f3e1bbe40559e36d6ef3c9d4005759d79898284d
Instruction Fuzzy Hash: 6B310711D1AA4742F29237785C032B9D221AFD279CFE0D3F2F59CB7492DF2CA9816961

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723433780 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c246991e1f74284f5649e54048b251cd1ea94e322516a693657980b1273579a8
Instruction ID: 1a1dcf7e529453143ea328cc8c3faa38d021fec455026fba65dc08c72b08406b
Opcode Fuzzy Hash: c246991e1f74284f5649e54048b251cd1ea94e322516a693657980b1273579a8
Instruction Fuzzy Hash: F021172AC2DFD751F713933E5407515D610AFF3285A90E72FFDA835C62E71557806218

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72343BB72 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0aa66f270af918538e2303510f0f9f9c35fc0592659bcd389bac8dcf8db605
Instruction ID: ed7f91d6aefc246415e6c625752ac0c34b3f888548f2c22d6efacaa3c8813a83
Opcode Fuzzy Hash: 0a0aa66f270af918538e2303510f0f9f9c35fc0592659bcd389bac8dcf8db605
Instruction Fuzzy Hash: 820146EAC24FBA42E723A3396943286D910AEF3589120E307FDF438E55F301B5D07220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F0A84 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7234F0A93
FlsGetValue.KERNEL32 ref: 00007FF7234F0AA8
FlsSetValue.KERNEL32 ref: 00007FF7234F0AC9
FlsSetValue.KERNEL32 ref: 00007FF7234F0AF6
FlsSetValue.KERNEL32 ref: 00007FF7234F0B07
FlsSetValue.KERNEL32 ref: 00007FF7234F0B18
SetLastError.KERNEL32 ref: 00007FF7234F0B33
FlsGetValue.KERNEL32 ref: 00007FF7234F0B69
FlsSetValue.KERNEL32 ref: 00007FF7234F0B88
FlsSetValue.KERNEL32 ref: 00007FF7234F0BB0
FlsSetValue.KERNEL32 ref: 00007FF7234F0BC1
FlsSetValue.KERNEL32 ref: 00007FF7234F0BD2

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1d9d1463bde43177cf18aa55609fb8b22d23d51d41d1136b8f841a48a328d859
Instruction ID: ff10bf2780f08a4c2e84e13eeafab8551e400c8fd532c082f6aec032c2014239
Opcode Fuzzy Hash: 1d9d1463bde43177cf18aa55609fb8b22d23d51d41d1136b8f841a48a328d859
Instruction Fuzzy Hash: 4E416C24E0964641F9E8B3729C41179D242DF947B8FDC4BF4D83EA66C7EE2CB4029A30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F1C20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FF7234F1A0C,?,?,00000000,00007FF7234F421B,?,?,00000003,00007FF7234DC93D), ref: 00007FF7234F1D9C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7234F1A0C,?,?,00000000,00007FF7234F421B,?,?,00000003,00007FF7234DC93D), ref: 00007FF7234F1DA8

Strings

MZx, xrefs: 00007FF7234F1C3F, 00007FF7234F1D25, 00007FF7234F1D85
ext-ms-, xrefs: 00007FF7234F1CF9
api-ms-, xrefs: 00007FF7234F1CE6

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 49ecb11a4a1fdacc19e0ee57c6bfa841f3663daebabf8c3ca99e5255bf30bf15
Instruction ID: bc94f7ea3ceecf51efb791a028b205fc489c5ef579820cc863d3867a3e17d2f8
Opcode Fuzzy Hash: 49ecb11a4a1fdacc19e0ee57c6bfa841f3663daebabf8c3ca99e5255bf30bf15
Instruction Fuzzy Hash: EC412A21B19A4281FA95EB26AC04175A3A1FF45BE0F8D41B9DD1DA7744DF3CF4468B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234B8550 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(?,?,00000000,00000000,..\..\third_party\boringssl\src\crypto\mem.c,00000010,00007FF7234802C1), ref: 00007FF7234B8593
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7234B894D,?,?,00000000,0000000E), ref: 00007FF7234B85AE
TlsGetValue.KERNEL32 ref: 00007FF7234B85BC
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7234B894D,?,?,00000000,0000000E), ref: 00007FF7234B85C7
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7234B894D,?,?,00000000,0000000E), ref: 00007FF7234B85F2
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7234B894D,?,?,00000000,0000000E), ref: 00007FF7234B8606
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7234B894D,?,?,00000000,0000000E), ref: 00007FF7234B861D

Strings

..\..\third_party\boringssl\src\crypto\mem.c, xrefs: 00007FF7234B8552

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireExecuteInitRelease
String ID: ..\..\third_party\boringssl\src\crypto\mem.c
API String ID: 389898287-3521738057
Opcode ID: 47aeba9d775173bdbd346469098e4105328542f8cb506207d7324444234af78b
Instruction ID: 6822f4b8e446e2ef44e8498d5bf2c6dbce25e9382e8e3ddbb8a01e8d6bc40b85
Opcode Fuzzy Hash: 47aeba9d775173bdbd346469098e4105328542f8cb506207d7324444234af78b
Instruction Fuzzy Hash: 2931A021E18A9685FAC0BB22AC14275E3A1EF44B94FC505F5DD0EA33A4DE3CE4458F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234FE304 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7234FE22B,?,?,?,00007FF7234ECDD6,?,?,?,00007FF7234ECD91), ref: 00007FF7234FE389
GetLastError.KERNEL32(?,?,00000000,00007FF7234FE22B,?,?,?,00007FF7234ECDD6,?,?,?,00007FF7234ECD91), ref: 00007FF7234FE397
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7234FE22B,?,?,?,00007FF7234ECDD6,?,?,?,00007FF7234ECD91), ref: 00007FF7234FE3C1
FreeLibrary.KERNEL32(?,?,00000000,00007FF7234FE22B,?,?,?,00007FF7234ECDD6,?,?,?,00007FF7234ECD91), ref: 00007FF7234FE407
GetProcAddress.KERNEL32(?,?,00000000,00007FF7234FE22B,?,?,?,00007FF7234ECDD6,?,?,?,00007FF7234ECD91), ref: 00007FF7234FE413

Strings

MZx, xrefs: 00007FF7234FE322, 00007FF7234FE3D2, 00007FF7234FE3F0
api-ms-, xrefs: 00007FF7234FE3A9

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: a881f3531f2500bb17f2fe5d353c5b28e9d77d57769165112504cb2ec66f1df1
Instruction ID: b1e9026b57f49821763fbc56571cbe338df374ba7cd731b7641f9f9059ff9f8f
Opcode Fuzzy Hash: a881f3531f2500bb17f2fe5d353c5b28e9d77d57769165112504cb2ec66f1df1
Instruction Fuzzy Hash: 7E31D221B1AA42C1EE91BB16AC44174E2D4FF04FA5F8D05B5DD2EA7745DF3CE4858B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234FFD0C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7234FFD3D
GetLastError.KERNEL32 ref: 00007FF7234FFD49
CloseHandle.KERNEL32 ref: 00007FF7234FFD61
CreateFileW.KERNEL32 ref: 00007FF7234FFD8C
WriteConsoleW.KERNEL32 ref: 00007FF7234FFDAB

Strings

CONOUT$, xrefs: 00007FF7234FFD6D

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 21f5e1a722e471fe4bbc904e988e135a008d2f82a4879c8fee5829c0ec276513
Instruction ID: 32f15000ab332f7a8b265bd102d9f5c45a3483a43b48ed9ea1d764b19c825fec
Opcode Fuzzy Hash: 21f5e1a722e471fe4bbc904e988e135a008d2f82a4879c8fee5829c0ec276513
Instruction Fuzzy Hash: 0C117222B18F4186F790AB22BC54325E2A4FB88FE4F844374EA5D97794CF7CD9448B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234E71D8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7234E7257
WriteFile.KERNEL32 ref: 00007FF7234E751F
WriteFile.KERNEL32 ref: 00007FF7234E7565
GetLastError.KERNEL32 ref: 00007FF7234E761B

Strings

MZx, xrefs: 00007FF7234E722E, 00007FF7234E72AF, 00007FF7234E7364

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: 958c168aa60ca71dac8217d736b1c79d147e2f57d71ead2838686994c559b34a
Instruction ID: 6db651e190d2f8deee99ac9f3087a8c92cdadb94d44cc5a8e0c0bc17c3273ede
Opcode Fuzzy Hash: 958c168aa60ca71dac8217d736b1c79d147e2f57d71ead2838686994c559b34a
Instruction Fuzzy Hash: 41D1F432B0868189E790DF79D8405BC7BB1FB047A8B8442B5CF5DA7B99DE38D406CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72344F910 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 289COMMON

Download Yara Rule

Strings

global/, xrefs: 00007FF72344FD08
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF7234500C1
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF7234500AE

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$global/
API String ID: 0-2781917089
Opcode ID: dd7e9386891f01b27c87518aee097cbcc777ad81183cc88fb25df6edefd856c4
Instruction ID: afef3dd39ae1615f0bdebd4efa8bfe3e8a35ac2569ea27d55caceed523d445d9
Opcode Fuzzy Hash: dd7e9386891f01b27c87518aee097cbcc777ad81183cc88fb25df6edefd856c4
Instruction Fuzzy Hash: F2A1F472A04B4982FAA49B26EC40379B3A1FB58B90F9446B1DF5D577A4DF3CE442CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234DC8C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7234DC8E9
GetProcAddress.KERNEL32 ref: 00007FF7234DC8FF
FreeLibrary.KERNEL32 ref: 00007FF7234DC926

Strings

CorExitProcess, xrefs: 00007FF7234DC8F8
mscoree.dll, xrefs: 00007FF7234DC8E0

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bdf0346ee0aa2e68e802cf6254122ea77f45b926a91ce1ce48fc5583cff7dc8a
Instruction ID: 06053e1eccff1c612987feb192ba14c315057d22024ee3cd3f0023a78e3cf287
Opcode Fuzzy Hash: bdf0346ee0aa2e68e802cf6254122ea77f45b926a91ce1ce48fc5583cff7dc8a
Instruction Fuzzy Hash: 44F0C261A1960681EB90AB35EC44339E360FF44BA1FD806B5CAAF665E4CF3CD645CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723510B92 Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetSecurityDescriptorControl.ADVAPI32 ref: 00007FF723510BD9

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ControlDescriptorSecurity
String ID:
API String ID: 3376414291-0
Opcode ID: 86407290c23bccbee870b6bbc5b807ac6293c244c6d354f7612f651999bfe80c
Instruction ID: 4f6dd2476d7a1510a3b9ff43f74b1b7864b240a327e743a4dab2d82e0a7b5e6a
Opcode Fuzzy Hash: 86407290c23bccbee870b6bbc5b807ac6293c244c6d354f7612f651999bfe80c
Instruction Fuzzy Hash: 8F51E311B1868241F694B733AC05379A390EF44B84F8495F1EE8E67791DE3CE942CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723511D20 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

GetSecurityDescriptorControl.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00007FF723511D0A), ref: 00007FF723511D62
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FF723511DC2
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FF723511DDA
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF723511DF6
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FF723511E21

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: DescriptorSecurity$ControlDaclGroupOwnerSacl
String ID:
API String ID: 1158139820-0
Opcode ID: ba4bfb120de2e325778a48ea896550356e35ce4dc003f592cc9d0f3d30cb02e4
Instruction ID: 8205f948017ad7ba6c4fbe3decadff063d9a996ded5180ab549573836adc04ec
Opcode Fuzzy Hash: ba4bfb120de2e325778a48ea896550356e35ce4dc003f592cc9d0f3d30cb02e4
Instruction Fuzzy Hash: C4314332619A8281D661EF62ED441AAB7F0FB88B84F804172EE8E57B54DF3CD546CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234FAB30 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7234FAB58
_set_statfp.LIBCMT ref: 00007FF7234FAB73
_set_statfp.LIBCMT ref: 00007FF7234FAB8F
_set_statfp.LIBCMT ref: 00007FF7234FABCB

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 3a671f99ee0fb86fe5a3f1c0d9c68e80201ce987232c96135fb73765a972c590
Instruction ID: 62e96bc7e3c89b8649301e7b42701527ffaca5fb85131cd5cd4418d3a60d275d
Opcode Fuzzy Hash: 3a671f99ee0fb86fe5a3f1c0d9c68e80201ce987232c96135fb73765a972c590
Instruction Fuzzy Hash: E511C426E2CA0341F6D43124ED463759142EF583B0F8C07F2EB6EA62F68F1CA8444E24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF723480040 Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(?,?,?,00000000,0000000E,00007FF7234B894D,?,?,00000000,0000000E,00007FF7234B89B9), ref: 00007FF723480078
GetLastError.KERNEL32(?,?,?,00000000,0000000E,00007FF7234B894D,?,?,00000000,0000000E,00007FF7234B89B9), ref: 00007FF72348008B
TlsGetValue.KERNEL32 ref: 00007FF723480099
SetLastError.KERNEL32(?,?,?,00000000,0000000E,00007FF7234B894D,?,?,00000000,0000000E,00007FF7234B89B9), ref: 00007FF7234800A4

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ErrorLastOnce$ExecuteInitValue
String ID:
API String ID: 2797425889-0
Opcode ID: 8dae1433bf2a06a01596302c6694d0793d5e98d716b8a889fddfb31d13097bf8
Instruction ID: 5cd35189275a6a32645c994dec86ee6919833588e7d998c302d0183f4aa245cd
Opcode Fuzzy Hash: 8dae1433bf2a06a01596302c6694d0793d5e98d716b8a889fddfb31d13097bf8
Instruction Fuzzy Hash: D3611712D2D6C183E6A4A721ED013FBA320FB99748F4253B5EB9F511A6CF2CF5D28650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234F0CC4 Relevance: 6.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsSetValue.KERNEL32(?,?,?,00007FF7234E2013,?,?,00000000,00007FF7234E1F2A), ref: 00007FF7234F0D02
FlsSetValue.KERNEL32(?,?,?,00007FF7234E2013,?,?,00000000,00007FF7234E1F2A), ref: 00007FF7234F0D2A
FlsSetValue.KERNEL32(?,?,?,00007FF7234E2013,?,?,00000000,00007FF7234E1F2A), ref: 00007FF7234F0D3B
FlsSetValue.KERNEL32(?,?,?,00007FF7234E2013,?,?,00000000,00007FF7234E1F2A), ref: 00007FF7234F0D4C

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 40ad6e9d10912426cd68590667285a86c761e172aaa11615f031b102b4414844
Instruction ID: db4976f53f584838b97b787b7b655ff5920b455b6e9139116095282f324e682b
Opcode Fuzzy Hash: 40ad6e9d10912426cd68590667285a86c761e172aaa11615f031b102b4414844
Instruction Fuzzy Hash: 7C119D20F08A4601FAD8B3229D41179A141DF907A0FCC07F5D83EA66CAEE2CF4025A30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234E7870 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7234E7987
GetLastError.KERNEL32 ref: 00007FF7234E79A9

Strings

U, xrefs: 00007FF7234E7933

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 25b6cd78dbc0bd81a34a7331496c36e54501b7356a3653b8bfd124951489cc91
Instruction ID: e4c2d1acd1180540cdc7e85bf7e39889c04cef6270d6055f490e1e7ac6d0ebf0
Opcode Fuzzy Hash: 25b6cd78dbc0bd81a34a7331496c36e54501b7356a3653b8bfd124951489cc91
Instruction Fuzzy Hash: 7441D422618A8185EB50AF25E8447B9A760FB88B94F844171EE4D97798DF3CD441CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7234CE85C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7234CDB5F), ref: 00007FF7234CE8A0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7234CDB5F), ref: 00007FF7234CE8E6

Strings

csm, xrefs: 00007FF7234CE8D3

Memory Dump Source

Source File: 00000006.00000002.1670421020.00007FF723431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF723430000, based on PE: true

Associated: 00000006.00000002.1670407428.00007FF723430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670511677.00007FF72358E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670537392.00007FF7235CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670550564.00007FF7235CC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670563745.00007FF7235CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670578825.00007FF7235E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670606239.00007FF7235E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670621669.00007FF7235F8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1670638391.00007FF7235FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff723430000_elevation_service.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ab2ffa6d8a4e9ce13128c576df08f82d8e162556ba4fa37a612a913b80fed03c
Instruction ID: 9544b6d378be9595f6dbabc61e277e9836f14e74f49ea825e821f561ea6b2b8a
Opcode Fuzzy Hash: ab2ffa6d8a4e9ce13128c576df08f82d8e162556ba4fa37a612a913b80fed03c
Instruction Fuzzy Hash: F2114F32A08B4582EB509F25F840269B7A1FB88F94F9846B1DF8D17798DF3CD5518B50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report elevation_service.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\servicereg.log

C:\servicestart.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 6336, Parent PID: 2696

General

Windows Analysis Report
elevation_service.exe

Function 00007FF7234F0BFC Relevance: 10.6, APIs: 7, Instructions: 57
COMMONLIBRARYCODE

Function 00007FF7234E6DB0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Function 00007FF7234DC958 Relevance: 4.5, APIs: 3, Instructions: 14
COMMONLIBRARYCODE

Function 00007FF7234F58E4 Relevance: 3.1, APIs: 2, Instructions: 89
COMMONLIBRARYCODE

Function 00007FF7234E7650 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 00007FF7234DC850 Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Function 00007FF7234DC844 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 00007FF7234CCB00 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON