Edit tour

Windows Analysis Report
iexplore.exe

Overview

General Information

Sample Name:	iexplore.exe
Analysis ID:	614265
MD5:	cfe2e6942ac1b72981b3105e22d3224e
SHA1:	8088e72e4ac09d5677fe4339f7823eeba445fb41
SHA256:	3aa971f794df79ec6e7d22a4d3b4f3eac1dfe8a8192601445baeffdf994e23e2
Tags:	exe
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

PE file contains strange resources

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to search for IE or Outlook window (often done to steal information)

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

iexplore.exe (PID: 6340 cmdline: "C:\Users\user\Desktop\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: iexplore.exe

Static PE information: certificate valid

Source: iexplore.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: iexplore.pdbUGP source: iexplore.exe
Source:	Binary string: iexplore.pdb source: iexplore.exe

Source: iexplore.exe, 00000000.00000003.264135400.0000017EC2E31000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000000.00000002.266185408.0000017EC2E32000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000000.00000002.266100701.0000017EC2E0F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000000.00000003.265292136.0000017EC2E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: iexplore.exe, 00000000.00000003.263423694.0000017EC2E3E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000000.00000003.265245559.0000017EC2E3E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000000.00000002.266203074.0000017EC2E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comted

Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iexplore.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: iexplore.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\iexplore.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Users\user\Desktop\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFE7AE82E40A504E27.TMP

Jump to behavior

Source: iexplore.exe	String found in binary or memory: -startmanager
Source: iexplore.exe	String found in binary or memory: kernelbase.dllRaiseFailFastExceptionwilonecore\internal\sdk\inc\wil\opensource\wil\resource.hWilError_03ntdll.dllRtlDisownModuleHeapAllocationRtlRegisterFeatureConfigurationChangeNotificationRtlUnregisterFeatureConfigurationChangeNotificationRtlNotifyFeatureUsageNtQueryWnfStateDataNtUpdateWnfStateDataRtlSubscribeWnfStateChangeNotificationRtlUnsubscribeWnfNotificationWaitForCompletiononecore\internal\sdk\inc\wil\Staging.hWilStaging_02SCODEF:CREDAT:-newtabIEFrame{28fb17e0-d393-439d-9a21-9474a070473a} -eval-new-nowaitkernel32.dllSetSearchPathModeInternet Explorer-ResetDestinationListResetDestinationList-embedding-startmanagerTerminateOnShutdownSoftware\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exeLocal\SM0:%d:%d:%hsm
Source: iexplore.exe	String found in binary or memory: Application-Addon-Event-ProviderOPCOT

Source: classification engine

Classification label: clean3.winEXE@1/2@0/0

Source: C:\Users\user\Desktop\iexplore.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: iexplore.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: iexplore.exe

Static PE information: certificate valid

Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: iexplore.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: iexplore.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: iexplore.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: iexplore.pdbUGP source: iexplore.exe
Source:	Binary string: iexplore.pdb source: iexplore.exe

Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: iexplore.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: iexplore.exe

Static PE information: section name: .didat

Source: iexplore.exe

Static PE information: 0x84C9557A [Sun Aug 5 13:45:30 2040 UTC]

Source: C:\Users\user\Desktop\iexplore.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: iexplore.exe, 00000000.00000002.265961834.0000017EC2DBD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7E18C16B0 InitializeCriticalSection,#798,CoCreateGuid,IsDebuggerPresent,#796,#797,#701,GetModuleHandleW,GetProcAddress,SetDllDirectoryW,SetErrorMode,GetCommandLineW,wcsncmp,LocalAlloc,StrStrIW,StrStrIW,StrStrIW,HeapSetInformation,#791,SetCurrentProcessExplicitAppUserModelID,StrStrIW,StrStrIW,FindWindowExW,GetWindowThreadProcessId,AllowSetForegroundWindow,StrStrIW,wcsncmp,iswspace,iswspace,iswspace,iswspace,wcsncmp,#796,StrStrIW,LocalFree,#650,#650,DeleteCriticalSection,RegGetValueW,GetCurrentProcess,TerminateProcess,

0_2_00007FF7E18C16B0

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7E18C422C GetProcessHeap,HeapAlloc,GetProcessHeap,

0_2_00007FF7E18C422C

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7E18C21C0 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,

0_2_00007FF7E18C21C0

Source: C:\Users\user\Desktop\iexplore.exe	Code function: 0_2_00007FF7E18C2B90 SetUnhandledExceptionFilter,		0_2_00007FF7E18C2B90
Source: C:\Users\user\Desktop\iexplore.exe	Code function: 0_2_00007FF7E18C28C4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7E18C28C4

Source: C:\Users\user\Desktop\iexplore.exe

Code function: 0_2_00007FF7E18C2D64 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF7E18C2D64

Source: C:\Users\user\Desktop\iexplore.exe

0_2_00007FF7E18C16B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Timestomp	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
iexplore.exe	0%	Virustotal	Browse
iexplore.exe	0%	Metadefender	Browse
iexplore.exe	0%	ReversingLabs

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	614265
Start date and time: 23/04/202207:38:09	2022-04-23 07:38:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	iexplore.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.winEXE@1/2@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 57.9%) Quality average: 41% Quality standard deviation: 40%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.82.209.183, 23.205.181.161
Excluded domains from analysis (whitelisted): e11290.dspg.akamaiedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, go.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, arc.trafficmanager.net, arc.msn.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27154F2B-C313-11EC-90EA-ECF4BB862DED}.dat

Download File

Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	2.0203607430207846
Encrypted:	false
SSDEEP:	24:roGo/QKX4EGo/uX4f4879lWLpza9lWLpz:roGo4KXZGomX6bCLpzjLpz
MD5:	D2216E2EB2DBB310BFE9E603B8CE8B64
SHA1:	74AD833EF3A79AA35B2F572CDAA9FD5825D4003D
SHA-256:	300D44E01788BD5F3D63ACD5251D0C5EF5E7E5DD601915C3514E1F45E3E853B1
SHA-512:	4F65983B8B73B26480BAD37B0D79D9E3A383302992AECA0CD06014D38ECC37F34240E6CCF3E23A409FFD0471C0FCB97928E1B838D704A91BAA1360F4D3826A09
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................R..W................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.L.E.8.V.J.x.P.D.7.B.G.Q.6.u.z.0.u.4.Y.t.7.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Temp\~DFE7AE82E40A504E27.TMP

Download File

Process:	C:\Users\user\Desktop\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.06972600651735868
Encrypted:	false
SSDEEP:	3:WmeXezollV//ll6hCu5lclllv/nt+lybltll1lRslkhlEkllLBeXexKwbXeZ:WBvP/KEu7UFAlkxDkf0
MD5:	BBD536EB3B9A204AE4D772457A6366D2
SHA1:	97B91D0C64EA22696DEE66E71ED535946588A000
SHA-256:	DABA85F4E0B352E9F7A81B0B39ECAD28192ED0AA9BD0A2C0CDCFBAED564E4DAB
SHA-512:	39C0FB42A5BAABF8DE02BBDEA7AC82BB7F1433EA2C0E202FEEEE9E9DC325B73351E1285C3BA4B5381AB9D35BC3F6830D5AC48C8CFEF3EC87BB59A243F6B7B8A8
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.499091086326622
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iexplore.exe
File size:	834512
MD5:	cfe2e6942ac1b72981b3105e22d3224e
SHA1:	8088e72e4ac09d5677fe4339f7823eeba445fb41
SHA256:	3aa971f794df79ec6e7d22a4d3b4f3eac1dfe8a8192601445baeffdf994e23e2
SHA512:	6685d24b4700c3f8c691412fe0dbbe2fd45067331d82cd5117b12544b94ab0311a2c92e4efc6f86f5e900be925329fffcbee778697d9b8dde7ee35a475a45da2
SSDEEP:	24576:rVe+4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMM+:rVfMMHMMMvMMZMMMlmMMMiMMMYJMMHM7
TLSH:	36056C42F7C8D495E0B706318933C7658672FC659E20866F3199771E2E723C36AB2E1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ea.....L...L...L.xdL...L.k.M...L.k.M...L.k.M...L.k.M...L...L...L.k.M...L.k.L...L.k.M...LRich...L................PE..d...zU.....

File Icon


Icon Hash:	e1e8ccdecccdf136

Static PE Info

General

Entrypoint:	0x140002870
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x84C9557A [Sun Aug 5 13:45:30 2040 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	7534c642bdcb1528e25e71d0ce72d8bb

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	9/2/2021 11:25:59 AM 9/1/2022 11:25:59 AM
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	E73EC761B09149A464F35E6532127D08
Thumbprint SHA-1:	44796EB5BD439B4BFB078E1DC2F8345AE313CBB1
Thumbprint SHA-256:	DE1C6B5E2219ED317E08701A91F86D41BEFA9E055693FDE97BE0B3132DB6A52B
Serial:	330000043A75E52F9E0B29981E00000000043A

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F63AD160D60h
dec eax
add esp, 28h
jmp 00007F63AD1605F3h
int3
int3
int3
int3
int3
int3
jmp dword ptr [00007C22h]
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [0000A821h]
jne 00007F63AD160882h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F63AD160873h
ret
dec eax
ror ecx, 10h
jmp 00007F63AD1608B7h
int3
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000796Bh]
dec eax
mov ecx, ebx
call dword ptr [0000796Ah]
call dword ptr [00007A0Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00007A10h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [0000A8BDh]
call dword ptr [00007947h]
dec eax
mov eax, dword ptr [0000A9A8h]
dec eax
mov dword ptr [esp+48h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+50h]
dec eax
mov ecx, dword ptr [esp+48h]
call dword ptr [00007920h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc110	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0xbd5a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x9fc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc9a00	0x21d0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0x7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xae80	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa188	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa060	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa1b0	0x3b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc040	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8104	0x8200	False	0.546664663462	data	6.06098689429	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x2da2	0x2e00	False	0.425611413043	data	4.84762234939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd000	0xb0c	0x200	False	0.142578125	data	0.844606909688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xe000	0x9fc	0xa00	False	0.51015625	data	4.49694066781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0xf000	0x38	0x200	False	0.06640625	data	0.345827309422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0xbd5a0	0xbd600	False	0.621472772277	data	6.46724294448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0x7c	0x200	False	0.23046875	data	1.44403813393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
EDPENLIGHTENEDAPPINFOID	0x2c4a0	0x2	data	English	United States
EDPPERMISSIVEAPPINFOID	0x2c4a8	0x2	data	English	United States
MUI	0xcd448	0x158	data	English	United States
WEVT_TEMPLATE	0x13130	0x1936a	data	English	United States
RT_ICON	0x2c4b0	0x668	data	English	United States
RT_ICON	0x2cb18	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0x2ce00	0x1e8	data	English	United States
RT_ICON	0x2cfe8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x2d110	0xea8	data	English	United States
RT_ICON	0x2dfb8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0x2e860	0x6c8	data	English	United States
RT_ICON	0x2ef28	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x2f490	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x3c088	0x25a8	data	English	United States
RT_ICON	0x3e630	0x10a8	data	English	United States
RT_ICON	0x3f6d8	0x988	data	English	United States
RT_ICON	0x40060	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x40588	0x668	data	English	United States
RT_ICON	0x40bf0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x40ed8	0x1e8	data	English	United States
RT_ICON	0x410c0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x411e8	0xea8	data	English	United States
RT_ICON	0x42090	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x42938	0x6c8	data	English	United States
RT_ICON	0x43000	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x43568	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x4cd40	0x25a8	data	English	United States
RT_ICON	0x4f2e8	0x10a8	data	English	United States
RT_ICON	0x50390	0x988	data	English	United States
RT_ICON	0x50d18	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x51240	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4160290815, next used block 0	English	United States
RT_ICON	0x51528	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x51dd0	0x10a8	data	English	United States
RT_ICON	0x52ea8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2004318071, next used block 32888	English	United States
RT_ICON	0x531a8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x53490	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x535b8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16120058, next used block 16120572	English	United States
RT_ICON	0x53e60	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x543c8	0x10a8	data	English	United States
RT_ICON	0x55470	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x55938	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1953286086, next used block 128	English	United States
RT_ICON	0x55c20	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x55d48	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15265516, next used block 14937073	English	United States
RT_ICON	0x565f0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x56b58	0x10a8	data	English	United States
RT_ICON	0x57c00	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x580c8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177497999, next used block 7374984	English	United States
RT_ICON	0x583b0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x58c58	0x10a8	data	English	United States
RT_ICON	0x59d30	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4287627263, next used block 8947847	English	United States
RT_ICON	0x5a018	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15724527, next used block 14870778	English	United States
RT_ICON	0x5a8c0	0x10a8	data	English	United States
RT_ICON	0x5b998	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177526783, next used block 15792376	English	United States
RT_ICON	0x5bc80	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5bda8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 14808529, next used block 15399129	English	United States
RT_ICON	0x5c650	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5cbb8	0x10a8	data	English	United States
RT_ICON	0x5dc60	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5e128	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 248, next used block 52302	English	United States
RT_ICON	0x5e410	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5e560	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5e688	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5ebf0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5f088	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5f1b0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5f718	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5fbb0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x5fcd8	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x60240	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x606d8	0x668	data	English	United States
RT_ICON	0x60d40	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x61028	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x61150	0xea8	data	English	United States
RT_ICON	0x61ff8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x628a0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x62e08	0x25a8	data	English	United States
RT_ICON	0x653b0	0x10a8	data	English	United States
RT_ICON	0x66458	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x66948	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4177497999, next used block 7374984	English	United States
RT_ICON	0x66c30	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x66d58	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x67600	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x67b68	0x10a8	data	English	United States
RT_ICON	0x68c10	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x690d8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x693c0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x694e8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x69d90	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6a2f8	0x10a8	data	English	United States
RT_ICON	0x6b3a0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6b868	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x6bb50	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6bc78	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x6c520	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6ca88	0x10a8	data	English	United States
RT_ICON	0x6db30	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6dff8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x6e2e0	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6e408	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16709604, next used block 16118257	English	United States
RT_ICON	0x6ecb0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6f218	0x10a8	data	English	United States
RT_ICON	0x702c0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x70788	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3337062286, next used block 28791	English	United States
RT_ICON	0x70a70	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x70b98	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 13036186, next used block 16055484	English	United States
RT_ICON	0x71440	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x719a8	0x10a8	data	English	United States
RT_ICON	0x72a50	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x72f18	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 51, next used block 0	English	United States
RT_ICON	0x73200	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x73328	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x73bd0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x74138	0x10a8	data	English	United States
RT_ICON	0x751e0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x756a8	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 16287887, next used block 0	English	United States
RT_ICON	0x75990	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16184819, next used block 16185078	English	United States
RT_ICON	0x76238	0x10a8	data	English	United States
RT_ICON	0x77310	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4294967295, next used block 7899271	English	United States
RT_ICON	0x775f8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x77ea0	0x10a8	data	English	United States
RT_ICON	0x78f78	0x668	data	English	United States
RT_ICON	0x795e0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4160749567, next used block 8423559	English	United States
RT_ICON	0x798c8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x799f0	0xea8	data	English	United States
RT_ICON	0x7a898	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x7b140	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x7b6a8	0x414c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x7f7f8	0x25a8	data	English	United States
RT_ICON	0x81da0	0x10a8	data	English	United States
RT_ICON	0x82e48	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x83348	0x668	data	English	United States
RT_ICON	0x839b0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0x83c98	0x1e8	data	English	United States
RT_ICON	0x83e80	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x83fa8	0xea8	data	English	United States
RT_ICON	0x84e50	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0x856f8	0x6c8	data	English	United States
RT_ICON	0x85dc0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x86328	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x92f20	0x25a8	data	English	United States
RT_ICON	0x954c8	0x10a8	data	English	United States
RT_ICON	0x96570	0x988	data	English	United States
RT_ICON	0x96ef8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x97420	0x668	data	English	United States
RT_ICON	0x97a88	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0x97d70	0x1e8	data	English	United States
RT_ICON	0x97f58	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x98080	0xea8	data	English	United States
RT_ICON	0x98f28	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0x997d0	0x6c8	data	English	United States
RT_ICON	0x99e98	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x9a400	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xa3bd8	0x25a8	data	English	United States
RT_ICON	0xa6180	0x10a8	data	English	United States
RT_ICON	0xa7228	0x988	data	English	United States
RT_ICON	0xa7bb0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xa80d8	0x668	data	English	United States
RT_ICON	0xa8740	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4008635955, next used block 770286	English	United States
RT_ICON	0xa8a28	0x1e8	data	English	United States
RT_ICON	0xa8c10	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xa8d38	0xea8	data	English	United States
RT_ICON	0xa9be0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16182429, next used block 16773761	English	United States
RT_ICON	0xaa488	0x6c8	data	English	United States
RT_ICON	0xaab50	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xab0b8	0xcbf1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xb7cb0	0x25a8	data	English	United States
RT_ICON	0xba258	0x10a8	data	English	United States
RT_ICON	0xbb300	0x988	data	English	United States
RT_ICON	0xbbc88	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xbc1b0	0x668	data	English	United States
RT_ICON	0xbc818	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 3096152115, next used block 7829367	English	United States
RT_ICON	0xbcb00	0x1e8	data	English	United States
RT_ICON	0xbcce8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xbce10	0xea8	data	English	United States
RT_ICON	0xbdcb8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16251127, next used block 16185593	English	United States
RT_ICON	0xbe560	0x6c8	data	English	United States
RT_ICON	0xbec28	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xbf190	0x97d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xc8968	0x25a8	data	English	United States
RT_ICON	0xcaf10	0x10a8	data	English	United States
RT_ICON	0xcbfb8	0x988	data	English	United States
RT_ICON	0xcc940	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0xbc0f0	0xbc	data	English	United States
RT_GROUP_ICON	0x97360	0xbc	data	English	United States
RT_GROUP_ICON	0xccda8	0xbc	data	English	United States
RT_GROUP_ICON	0xa8018	0xbc	data	English	United States
RT_GROUP_ICON	0x404c8	0xbc	data	English	United States
RT_GROUP_ICON	0x51180	0xbc	data	English	United States
RT_GROUP_ICON	0x52e78	0x30	data	English	United States
RT_GROUP_ICON	0x53190	0x14	data	English	United States
RT_GROUP_ICON	0x58068	0x5a	data	English	United States
RT_GROUP_ICON	0x558d8	0x5a	data	English	United States
RT_GROUP_ICON	0x59d00	0x30	data	English	United States
RT_GROUP_ICON	0x5b968	0x30	data	English	United States
RT_GROUP_ICON	0x5e538	0x22	data	English	United States
RT_GROUP_ICON	0x5e0c8	0x5a	data	English	United States
RT_GROUP_ICON	0x72eb8	0x5a	data	English	United States
RT_GROUP_ICON	0x5f058	0x30	data	English	United States
RT_GROUP_ICON	0x5fb80	0x30	data	English	United States
RT_GROUP_ICON	0x606a8	0x30	data	English	United States
RT_GROUP_ICON	0x75648	0x5a	data	English	United States
RT_GROUP_ICON	0x668c0	0x84	data	English	United States
RT_GROUP_ICON	0x69078	0x5a	data	English	United States
RT_GROUP_ICON	0x6b808	0x5a	data	English	United States
RT_GROUP_ICON	0x6df98	0x5a	data	English	United States
RT_GROUP_ICON	0x70728	0x5a	data	English	United States
RT_GROUP_ICON	0x772e0	0x30	data	English	United States
RT_GROUP_ICON	0x78f48	0x30	data	English	United States
RT_GROUP_ICON	0x832b0	0x92	data	English	United States
RT_VERSION	0xcce68	0x5e0	data	English	United States
RT_MANIFEST	0x12960	0x7c9	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	GetWindowThreadProcessId, AllowSetForegroundWindow, FindWindowExW, SendMessageTimeoutW, IsWindowVisible, SetUserObjectInformationW, IsWindowEnabled
msvcrt.dll	_onexit, __dllonexit, _unlock, _lock, memset, _commode, __C_specific_handler, _vsnwprintf, memcpy_s, iswspace, ?terminate@@YAXXZ, _purecall, memmove_s, _fmode, _wcmdln, _initterm, __setusermatherr, _cexit, _exit, exit, __set_app_type, wcsncmp, free, _XcptFilter, _amsg_exit, __wgetmainargs, memcmp
KERNEL32.dll	CreateThreadpoolTimer, ReleaseSRWLockShared, SetThreadpoolTimer, CloseHandle, HeapSetInformation, WaitForSingleObjectEx, DelayLoadFailureHook, ResolveDelayLoadedAPI, GetProcAddress, HeapAlloc, OpenSemaphoreW, IsDebuggerPresent, AcquireSRWLockExclusive, GetTickCount, GetSystemTimeAsFileTime, QueryPerformanceCounter, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetStartupInfoW, Sleep, CloseThreadpoolTimer, SetDllDirectoryW, DebugBreak, GetModuleHandleW, GetProcessHeap, GetCurrentProcessId, DeleteCriticalSection, AcquireSRWLockShared, LocalFree, GetModuleFileNameA, CreateSemaphoreExW, HeapFree, SetLastError, EnterCriticalSection, GetCommandLineW, GetCurrentProcess, ReleaseSemaphore, GetModuleHandleExW, TerminateProcess, LeaveCriticalSection, InitializeCriticalSection, SetErrorMode, InitializeCriticalSectionEx, WaitForThreadpoolTimerCallbacks, WaitForSingleObject, LocalAlloc, GetCurrentThreadId, ReleaseMutex, FormatMessageW, GetLastError, ReleaseSRWLockExclusive, OutputDebugStringW, CreateMutexExW
api-ms-win-downlevel-advapi32-l1-1-0.dll	RegGetValueW, EventRegister, EventWriteTransfer, EventWriteEx, EventUnregister
api-ms-win-downlevel-shell32-l1-1-0.dll	SetCurrentProcessExplicitAppUserModelID
ADVAPI32.dll	EventSetInformation
iertutil.dll
api-ms-win-downlevel-shlwapi-l1-1-0.dll	StrStrIW
api-ms-win-downlevel-ole32-l1-1-0.dll	CoCreateGuid

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	iexplore
FileVersion	11.00.19041.1566 (WinBuild.160101.0800)
CompanyName	Microsoft Corporation
ProductName	Internet Explorer
ProductVersion	11.00.19041.1566
FileDescription	Internet Explorer
OriginalFilename	IEXPLORE.EXE
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	iexplore
FileVersion	11.00.19041.1566
CompanyName	Microsoft Corporation
ProductName	Internet Explorer
ProductVersion	11.00.19041.1566
FileDescription	Internet Explorer
OriginalFilename	IEXPLORE.EXE
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• iexplore.exe

Click to jump to process

Memory Usage

• iexplore.exe

Click to jump to process

Target ID:	0
Start time:	07:39:17
Start date:	23/04/2022
Path:	C:\Users\user\Desktop\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\iexplore.exe"
Imagebase:	0x7ff7e18c0000
File size:	834512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.4%
Total number of Nodes:	756
Total number of Limit Nodes:	5

Executed Functions

Function 00007FF7E18C16B0 Relevance: 103.9, APIs: 41, Strings: 18, Instructions: 629memoryregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E18C6780: EventRegister.API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0(?,?,?,?,00007FF7E18C16CF), ref: 00007FF7E18C67A7

InitializeCriticalSection.KERNEL32 ref: 00007FF7E18C16F4
#798.IERTUTIL ref: 00007FF7E18C1710
CoCreateGuid.API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0 ref: 00007FF7E18C1730
IsDebuggerPresent.KERNEL32 ref: 00007FF7E18C1770
#796.IERTUTIL ref: 00007FF7E18C17CE
#797.IERTUTIL ref: 00007FF7E18C181F
#701.IERTUTIL ref: 00007FF7E18C1862
GetModuleHandleW.KERNEL32 ref: 00007FF7E18C1896
GetProcAddress.KERNEL32 ref: 00007FF7E18C18B1
SetDllDirectoryW.KERNEL32 ref: 00007FF7E18C18D4
SetErrorMode.KERNEL32 ref: 00007FF7E18C18E5
GetCommandLineW.KERNEL32 ref: 00007FF7E18C18F1
wcsncmp.MSVCRT ref: 00007FF7E18C1910
LocalAlloc.KERNEL32 ref: 00007FF7E18C19B9
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1A5C
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1ABC
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1B19
HeapSetInformation.KERNEL32 ref: 00007FF7E18C1B9B
#791.IERTUTIL ref: 00007FF7E18C1BB1
SetCurrentProcessExplicitAppUserModelID.API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0 ref: 00007FF7E18C1BD1
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1BF6
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1CA0
FindWindowExW.USER32 ref: 00007FF7E18C1CFF
GetWindowThreadProcessId.USER32 ref: 00007FF7E18C1D1A
AllowSetForegroundWindow.USER32 ref: 00007FF7E18C1D29
StrStrIW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0 ref: 00007FF7E18C1D67
wcsncmp.MSVCRT ref: 00007FF7E18C1DE9
iswspace.MSVCRT ref: 00007FF7E18C1E05
iswspace.MSVCRT ref: 00007FF7E18C1E23
iswspace.MSVCRT ref: 00007FF7E18C1E36
iswspace.MSVCRT ref: 00007FF7E18C1E4E
wcsncmp.MSVCRT ref: 00007FF7E18C1E6E
#796.IERTUTIL ref: 00007FF7E18C1EBE
LocalFree.KERNEL32 ref: 00007FF7E18C1FC9
#650.IERTUTIL ref: 00007FF7E18C202D
#650.IERTUTIL ref: 00007FF7E18C205E
DeleteCriticalSection.KERNEL32 ref: 00007FF7E18C2097
RegGetValueW.KERNEL32 ref: 00007FF7E18C20EA
GetCurrentProcess.KERNEL32 ref: 00007FF7E18C210C
TerminateProcess.KERNEL32 ref: 00007FF7E18C211E

Strings

SCODEF:, xrefs: 00007FF7E18C1DDF
-ResetDestinationList, xrefs: 00007FF7E18C1BEA
-nowait, xrefs: 00007FF7E18C1B0F
kernel32.dll, xrefs: 00007FF7E18C188F
{28fb17e0-d393-439d-9a21-9474a070473a} , xrefs: 00007FF7E18C1903
-new, xrefs: 00007FF7E18C1AB2
-startmanager, xrefs: 00007FF7E18C1F73
-embedding, xrefs: 00007FF7E18C1F35
IEFrame, xrefs: 00007FF7E18C1CF3
Microsoft.InternetExplorer.Default, xrefs: 00007FF7E18C1BBF
CREDAT:, xrefs: 00007FF7E18C1E64
TerminateOnShutdown, xrefs: 00007FF7E18C20BA
-eval, xrefs: 00007FF7E18C1A52
SetSearchPathMode, xrefs: 00007FF7E18C18A7
Microsoft.InternetExplorer.Preview, xrefs: 00007FF7E18C1BC6
-newtab, xrefs: 00007FF7E18C1C96, 00007FF7E18C1D5A
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe, xrefs: 00007FF7E18C20D1
Internet Explorer, xrefs: 00007FF7E18C1814

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: Processiswspace$Windowwcsncmp$#650#796CriticalCurrentLocalSection$#701#791#797#798AddressAllocAllowCommandCreateDebuggerDeleteDirectoryErrorEventExplicitFindForegroundFreeGuidHandleHeapInformationInitializeLineModeModelModulePresentProcRegisterTerminateThreadUserValue
String ID: -ResetDestinationList$-embedding$-eval$-new$-newtab$-nowait$-startmanager$CREDAT:$IEFrame$Internet Explorer$Microsoft.InternetExplorer.Default$Microsoft.InternetExplorer.Preview$SCODEF:$SetSearchPathMode$Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe$TerminateOnShutdown$kernel32.dll${28fb17e0-d393-439d-9a21-9474a070473a}
API String ID: 1949848870-2116736064
Opcode ID: 0f0148360dc6c43878f7a9744ee8bffc50bf3aadc59eb82bce75812f3816197e
Instruction ID: 5ff545c2397966c7dee0f8739a7cdbaee7190182cd36aec11269242ee56845c4
Opcode Fuzzy Hash: 0f0148360dc6c43878f7a9744ee8bffc50bf3aadc59eb82bce75812f3816197e
Instruction Fuzzy Hash: 32524125A08742C6EB20AB14E4563B9F7A1FF45B64F848136CA4E03794EFBCE465C723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C21C0 Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrResolveDelayLoadedAPI.NTDLL ref: 00007FF7E18C21EB

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: DelayLoadedResolve
String ID:
API String ID: 841769287-0
Opcode ID: fd89166e9313d2547a46168cd6d01029742f4c44403c20cb216b718d438abc21
Instruction ID: b246d26f11217793982d662cb02fb06e10995eab87f2f5ae01ababbb5e678cb8
Opcode Fuzzy Hash: fd89166e9313d2547a46168cd6d01029742f4c44403c20cb216b718d438abc21
Instruction Fuzzy Hash: 65E0B674908B8286D710AB00EC02269FB60FB897A8FD04133D94D43320EF7C9164CB16

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C2B90 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E18C2B9B

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f287afc6fd8ae868f8f6214d16c592652df8966cb88c41ca673cac106e70ef23
Instruction ID: 2e593d87ae9a303ef73ada8509dd57883967e5d424dae82707cc91c185dac935
Opcode Fuzzy Hash: f287afc6fd8ae868f8f6214d16c592652df8966cb88c41ca673cac106e70ef23
Instruction Fuzzy Hash: 51B09214E29512C1D708BB21DC9616093A1BB9C720FC00832C00E85160EEAC91ABC712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C2600 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7E18C2628
Sleep.KERNEL32 ref: 00007FF7E18C265F
_amsg_exit.MSVCRT ref: 00007FF7E18C267D
_initterm.MSVCRT ref: 00007FF7E18C2708
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E18C2735
exit.KERNELBASE ref: 00007FF7E18C27DA
_cexit.MSVCRT ref: 00007FF7E18C27E9

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: e734e849fc222a78f7db0f43c1a720059c7842eede69e40175245adcea5765f7
Instruction ID: 4816ca4221156a84ad9bd2b324fcb2ef2cb6f180d1b7da09995bf8e5afaafd3f
Opcode Fuzzy Hash: e734e849fc222a78f7db0f43c1a720059c7842eede69e40175245adcea5765f7
Instruction Fuzzy Hash: 8E613A31A0C70282EB64BB14E892739B2A2FB94760F944137D94D936D4DFBCE861C763

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C2150 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#701.IERTUTIL ref: 00007FF7E18C216A

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: #701
String ID:
API String ID: 1014962704-0
Opcode ID: 7a5347c738d304c9b440640a1c2f359192b4627c723dab30d68333a853e82a82
Instruction ID: 868fcee028cfaa4cbd4e7b084f9ffdf36f77a0f6c2b709291905bdc41111a539
Opcode Fuzzy Hash: 7a5347c738d304c9b440640a1c2f359192b4627c723dab30d68333a853e82a82
Instruction Fuzzy Hash: E9015E35A08742C7E324BF18A851374FAA1BBC8750F804137DA4D83290DBBCE524C663

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C25B0 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF7E18C25E8

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: ac8620aa60852997f68d015af7cd2ee7313d39221b728e796da7eb808a66c23c
Instruction ID: d00455d5feb78899f3a5186ecef6776c2562df334b2dc941b022199c8829708f
Opcode Fuzzy Hash: ac8620aa60852997f68d015af7cd2ee7313d39221b728e796da7eb808a66c23c
Instruction Fuzzy Hash: 1CE05974E08B43D5E700BB51B8626A1F7A1BBA4324BC04237C44C62220EFBCA165CBA3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E18C2D64 Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E18C2D94
GetCurrentProcessId.KERNEL32 ref: 00007FF7E18C2DA2
GetCurrentThreadId.KERNEL32 ref: 00007FF7E18C2DAE
GetTickCount.KERNEL32 ref: 00007FF7E18C2DBA
GetTickCount.KERNEL32 ref: 00007FF7E18C2DCA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E18C2DE5

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 8e8f9e4056e2bbebc1ed311f54f3e1c5b6b820bcf261d82402f450724497577d
Instruction ID: f4e5978e25e607403d582e6ed938a5c6b35929ca8383e464caaadfea852490e6
Opcode Fuzzy Hash: 8e8f9e4056e2bbebc1ed311f54f3e1c5b6b820bcf261d82402f450724497577d
Instruction Fuzzy Hash: 56116322605F418AEB00EF70E85536873A4FB49768F800A32EA6D47754EFBCD5B5C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C422C Relevance: 3.8, APIs: 3, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF7E18C5B9D,?,?,?,00007FF7E18C4953), ref: 00007FF7E18C423B
HeapAlloc.KERNEL32(?,?,?,00007FF7E18C5B9D,?,?,?,00007FF7E18C4953), ref: 00007FF7E18C424F
GetProcessHeap.KERNEL32(?,?,?,00007FF7E18C5B9D,?,?,?,00007FF7E18C4953), ref: 00007FF7E18C4268

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: Heap$Process$Alloc
String ID:
API String ID: 651230671-0
Opcode ID: 6c4630cb0f5c3c6e0ad4446469ac008e7e9d376c98fc29dae74cb438b0e3ae69
Instruction ID: ad28f4374353c90a2c4503f428a4b46a735c6932f4863be90335fc3ac2b51553
Opcode Fuzzy Hash: 6c4630cb0f5c3c6e0ad4446469ac008e7e9d376c98fc29dae74cb438b0e3ae69
Instruction Fuzzy Hash: 8CF0DA31A05B5182DB046B56B849379EBA2FB8DFA1F889136DA0E47320DF7CD4A5C612

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C75E0 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32 ref: 00007FF7E18C76C7
GetCurrentThreadId.KERNEL32 ref: 00007FF7E18C774B

Strings

LogHr, xrefs: 00007FF7E18C7681
[%hs(%hs)], xrefs: 00007FF7E18C7806
FailFast, xrefs: 00007FF7E18C7678
%hs(%u)\%hs!%p: , xrefs: 00007FF7E18C76F3
(caller: %p) , xrefs: 00007FF7E18C7736
Exception, xrefs: 00007FF7E18C7693
, xrefs: 00007FF7E18C77A9
[%hs], xrefs: 00007FF7E18C781F
Msg:[%ws] , xrefs: 00007FF7E18C77C4
ReturnHr, xrefs: 00007FF7E18C768A
CallContext:[%hs] , xrefs: 00007FF7E18C77DF
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF7E18C7764
%hs!%p: , xrefs: 00007FF7E18C7713

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: c305d1960df873b23188e55ad2329bcf09f9214f711e6ebf8f7b75fb575bf485
Instruction ID: c364da853b5b0d800e84ad22ad54f494375a7b0611fadd07f7544670cbc1f74e
Opcode Fuzzy Hash: c305d1960df873b23188e55ad2329bcf09f9214f711e6ebf8f7b75fb575bf485
Instruction Fuzzy Hash: AC617E61A08B8281EB64EF51A8567B6A3A0FF44BA8FC44137DA8D13754DFBCE461C713

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C7CB0 Relevance: 12.1, APIs: 8, Instructions: 102
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,?,00000000,00007FF7E18C8D3C), ref: 00007FF7E18C7CC2

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 311056b2069fe22c9f6a453dd4702220405004c7f4f79dbab0d936f72ecc0ab7
Instruction ID: f815caf9000ad5aaf96462040f72b287f1385b43c0ff8d9c53f734f4b585dce5
Opcode Fuzzy Hash: 311056b2069fe22c9f6a453dd4702220405004c7f4f79dbab0d936f72ecc0ab7
Instruction Fuzzy Hash: B941463260C74287E7606B21D402379E661EF85BB0F959133DA5E42798DFBCD8A4CA23

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C40E4 Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockShared.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C4105
ReleaseSRWLockShared.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C4125
EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C4145
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C4154
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C41AC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF7E18C421E,?,?,?,?,00007FF7E18C2FEC), ref: 00007FF7E18C41D1

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: Lock$AcquireCriticalExclusiveReleaseSectionShared$EnterLeave
String ID:
API String ID: 3221859647-0
Opcode ID: ac8a0eec957fd3451228aa59b364505a3a3f261b1bede1026a51b482b7202545
Instruction ID: f8b2577752c8f1ef377f498ab5ec76e8fc4a91659e2d753fd54cac68f1a30688
Opcode Fuzzy Hash: ac8a0eec957fd3451228aa59b364505a3a3f261b1bede1026a51b482b7202545
Instruction Fuzzy Hash: 6531B422B08F5186EB019F11A901279EB61FB99FE0F899132DE4E07B04DFBCD495C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C6280 Relevance: 9.0, APIs: 7, Instructions: 208
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E18C62BE

Part of subcall function 00007FF7E18C5E40: GetProcAddress.KERNEL32 ref: 00007FF7E18C5E6B

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C635D
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C6371
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C637D
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C6391
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C6545
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E18C5DEC), ref: 00007FF7E18C6559

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: Heap$Process$Free$AddressAllocProcmemset
String ID:
API String ID: 2515388404-0
Opcode ID: 428b59a5c627357b6c47cd94d171436bf6ea1c0a8a756d576f1fb126026135ba
Instruction ID: 1cc1d7412ccdda5d58585cc5d25377659a8b64c6986cf1aef9705c2715a154b0
Opcode Fuzzy Hash: 428b59a5c627357b6c47cd94d171436bf6ea1c0a8a756d576f1fb126026135ba
Instruction Fuzzy Hash: FF91A032A04B618AEB20DF62E4416ADB7B0FB58B58B948136DF4E53754EF78D060C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C8C10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32 ref: 00007FF7E18C8CE3
GetLastError.KERNEL32 ref: 00007FF7E18C8CF9
OpenSemaphoreW.KERNEL32 ref: 00007FF7E18C8DE9

Strings

_p0, xrefs: 00007FF7E18C8C94

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: OpenSemaphore$ErrorLast
String ID: _p0
API String ID: 3042991519-2437413317
Opcode ID: 06f6d63e7a808263af5b1a45eb0c5cd3e88966f292146e1fdad6c838f392df62
Instruction ID: d549e7bcc98646916c0c7c23bca78b0bef9aa516c3cff89e9a209673d3108800
Opcode Fuzzy Hash: 06f6d63e7a808263af5b1a45eb0c5cd3e88966f292146e1fdad6c838f392df62
Instruction Fuzzy Hash: 8661A272A0878285EB20EB14E0523BAE3A0EF967A0FD54133DA4D43745EFBCD551C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C6F18 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7E18C6F44
CreateMutexExW.KERNEL32 ref: 00007FF7E18C6F8F

Part of subcall function 00007FF7E18C5C68: GetLastError.KERNEL32 ref: 00007FF7E18C5C8A

Strings

x, xrefs: 00007FF7E18C6F5F
Local\SM0:%d:%d:%hs, xrefs: 00007FF7E18C6F55

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexProcess
String ID: Local\SM0:%d:%d:%hs$x
API String ID: 3298007088-4178846994
Opcode ID: ef2503423aa31f09ab1b4e4e6865b8e5012a9e4eeae409d4bfa19e10f7428300
Instruction ID: 90913259da5f179549db33342bca03b99379ab6918b444666a338e434ef5d50f
Opcode Fuzzy Hash: ef2503423aa31f09ab1b4e4e6865b8e5012a9e4eeae409d4bfa19e10f7428300
Instruction Fuzzy Hash: 9D31423161C74282EB50AB24E4963AAF3A0EB94790FC05136EA8E87795DFBCD454C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C5740 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E18C575F
GetProcAddress.KERNEL32 ref: 00007FF7E18C5775

Strings

RaiseFailFastException, xrefs: 00007FF7E18C576E
kernelbase.dll, xrefs: 00007FF7E18C5755

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 90237418f5489c81e568102f06743583406f8a2b20e5fed18a6678c408f941af
Instruction ID: 672c0b1be9e3c0d913aa0ae9797a2b67f8c1266e49ba88d6da9a83cb3eb6c923
Opcode Fuzzy Hash: 90237418f5489c81e568102f06743583406f8a2b20e5fed18a6678c408f941af
Instruction Fuzzy Hash: CFF03A25B08BA1C2EB00AB02F485179EB61FB49FE0B849036DA0E07B14EF7CD4A5C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C28A0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E18C2913
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E18C2932
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E18C297F
__raise_securityfailure.LIBCMT ref: 00007FF7E18C2A64

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: b5a2cf00e08f24f35519b55053e37a0498c6299b266642f78a809fcaf47f59d5
Instruction ID: 7a3a340e0959e54b283274ce44246adf405213ceda2a39421e151c314d45af6a
Opcode Fuzzy Hash: b5a2cf00e08f24f35519b55053e37a0498c6299b266642f78a809fcaf47f59d5
Instruction Fuzzy Hash: 9241A635A08B0185EB10AB08F8A2365F365FBC87A4F904237D98D537A4DFBDE465C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C5424 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7E18C54E8,?,?,?,?,?,?,?,?,00007FF7E18C24B5), ref: 00007FF7E18C5445
AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF7E18C54E8,?,?,?,?,?,?,?,?,00007FF7E18C24B5), ref: 00007FF7E18C5454
ReleaseSRWLockExclusive.KERNEL32(?,?,?,00007FF7E18C54E8,?,?,?,?,?,?,?,?,00007FF7E18C24B5), ref: 00007FF7E18C548B
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E18C54E8,?,?,?,?,?,?,?,?,00007FF7E18C24B5), ref: 00007FF7E18C549F

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CriticalExclusiveLockSection$AcquireEnterLeaveRelease
String ID:
API String ID: 1115728412-0
Opcode ID: 0f7df9b6096091a0eda25337a9051e2c79742103f04dcbea3f569fa167144b4c
Instruction ID: 0da4e7e60845b6e8b26a52b1229b43fc0f04ff28545a92d6c7ea7f325995b141
Opcode Fuzzy Hash: 0f7df9b6096091a0eda25337a9051e2c79742103f04dcbea3f569fa167144b4c
Instruction Fuzzy Hash: 5A0140A2B18B8282DF149F11A555278EB61FB8EFD1B989232DE4E03714DF7CD491C702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C35F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7E18C3625
CreateMutexExW.KERNEL32 ref: 00007FF7E18C366D

Part of subcall function 00007FF7E18C5C68: GetLastError.KERNEL32 ref: 00007FF7E18C5C8A

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7E18C3636

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexProcess
String ID: Local\SM0:%d:%d:%hs
API String ID: 3298007088-4162240545
Opcode ID: a03f0cf941183372015bcfc4ec3ea1b60ba38ffcc7d119e64e780811779cb604
Instruction ID: debe2430601f5f8c8789438de5bc81459afde2f33c8cc14095485c37ac072355
Opcode Fuzzy Hash: a03f0cf941183372015bcfc4ec3ea1b60ba38ffcc7d119e64e780811779cb604
Instruction Fuzzy Hash: A9417232618B4286EB10EB15E4817AAF3A0FB98790FC04036EA4D47B59DFBCD555C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E18C7084 Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF7E18C6E68,?,?,?,00007FF7E18C826F), ref: 00007FF7E18C70B9
HeapFree.KERNEL32(?,?,00000000,00007FF7E18C6E68,?,?,?,00007FF7E18C826F), ref: 00007FF7E18C70CD
GetProcessHeap.KERNEL32(?,?,00000000,00007FF7E18C6E68,?,?,?,00007FF7E18C826F), ref: 00007FF7E18C70F1
HeapFree.KERNEL32(?,?,00000000,00007FF7E18C6E68,?,?,?,00007FF7E18C826F), ref: 00007FF7E18C7105

Memory Dump Source

Source File: 00000000.00000002.266693300.00007FF7E18C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E18C0000, based on PE: true

Associated: 00000000.00000002.266688039.00007FF7E18C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266723235.00007FF7E18CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266742103.00007FF7E18CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266765601.00007FF7E18CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.266771739.00007FF7E18D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e18c0000_iexplore.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: b48126e289383ea1a3766ba9d6cd6342a985ef06311d3cc3f288c71a0fd3198b
Instruction ID: 93d887c6139d92c6b20b0825cd05a42430993f87876a5066946b2096e3aa8540
Opcode Fuzzy Hash: b48126e289383ea1a3766ba9d6cd6342a985ef06311d3cc3f288c71a0fd3198b
Instruction Fuzzy Hash: 28114C32A04B61C6DB009F56F4041ACFBB1F749F91B888126DB4E03718DF78E4A2C741

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iexplore.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27154F2B-C313-11EC-90EA-ECF4BB862DED}.dat

C:\Users\user\AppData\Local\Temp\~DFE7AE82E40A504E27.TMP

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: iexplore.exePID: 6340, Parent PID: 4800

General

File Activities

File Opened

File Created

File Deleted

File Written

File Read

Windows Analysis Report
iexplore.exe

Function 00007FF7E18C21C0 Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Function 00007FF7E18C2B90 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON