Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
clearbrowser.exe

Overview

General Information

Sample Name:clearbrowser.exe
Analysis ID:791478
MD5:eb2613474de36296e716ceacc646b17c
SHA1:94525e9da51964c07fcc25e907e400a8589bac5c
SHA256:fc3c5130d9311ce90835906d842fd7e5e4da00de249a55d1c1832734c2c84dea
Infos:
Errors
  • Corrupt sample or wrongly selected analyzer. Details: C0150002
  • Corrupt sample or wrongly selected analyzer. Details: C0150002
  • Corrupt sample or wrongly selected analyzer. Details: C0150002

Detection

Score:36
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Multi AV Scanner detection for submitted file
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
PE file contains more sections than normal
Program does not show much activity (idle)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • clearbrowser.exe (PID: 712 cmdline: "C:\Users\user\Desktop\clearbrowser.exe" -install MD5: EB2613474DE36296E716CEACC646B17C)
  • clearbrowser.exe (PID: 6108 cmdline: "C:\Users\user\Desktop\clearbrowser.exe" /install MD5: EB2613474DE36296E716CEACC646B17C)
  • clearbrowser.exe (PID: 3484 cmdline: "C:\Users\user\Desktop\clearbrowser.exe" /load MD5: EB2613474DE36296E716CEACC646B17C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: clearbrowser.exeReversingLabs: Detection: 12%
Source: clearbrowser.exeVirustotal: Detection: 7%Perma Link
Source: clearbrowser.exeStatic PE information: certificate valid
Source: clearbrowser.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: chrome.exe.pdb source: clearbrowser.exe
Source: clearbrowser.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: clearbrowser.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: clearbrowser.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: clearbrowser.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: clearbrowser.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: clearbrowser.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: clearbrowser.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: clearbrowser.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: clearbrowser.exeString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: clearbrowser.exeString found in binary or memory: http://ocsp.digicert.com0
Source: clearbrowser.exeString found in binary or memory: http://ocsp.digicert.com0A
Source: clearbrowser.exeString found in binary or memory: http://ocsp.digicert.com0C
Source: clearbrowser.exeString found in binary or memory: http://ocsp.digicert.com0X
Source: clearbrowser.exeString found in binary or memory: http://www.digicert.com/CPS0
Source: clearbrowser.exeString found in binary or memory: https://crashpad.chromium.org/
Source: clearbrowser.exeString found in binary or memory: https://crashpad.chromium.org/bug/new
Source: clearbrowser.exeString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D3EF00_2_00007FF6147D3EF0
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D3B000_2_00007FF6147D3B00
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D61200_2_00007FF6147D6120
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D275E0_2_00007FF6147D275E
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D17600_2_00007FF6147D1760
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D32600_2_00007FF6147D3260
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D3C600_2_00007FF6147D3C60
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D40900_2_00007FF6147D4090
Source: clearbrowser.exeStatic PE information: Number of sections : 14 > 10
Source: clearbrowser.exeReversingLabs: Detection: 12%
Source: clearbrowser.exeVirustotal: Detection: 7%
Source: unknownProcess created: C:\Users\user\Desktop\clearbrowser.exe "C:\Users\user\Desktop\clearbrowser.exe" -install
Source: unknownProcess created: C:\Users\user\Desktop\clearbrowser.exe "C:\Users\user\Desktop\clearbrowser.exe" /install
Source: unknownProcess created: C:\Users\user\Desktop\clearbrowser.exe "C:\Users\user\Desktop\clearbrowser.exe" /load
Source: clearbrowser.exeString found in binary or memory: Try '%ls --help' for more information.
Source: clearbrowser.exeString found in binary or memory: Try '%ls --help' for more information.
Source: clearbrowser.exeString found in binary or memory: partition_alloc/address_space
Source: clearbrowser.exeString found in binary or memory: ABCDEFGTScopedAllowBaseSyncPrimitivesOutsideBlockingScopeverifier.dllNtQuerySystemInformation..\..\base\threading\thread.ccStopSoonmalloc/partitionsmalloc/metadata_fragmentation_cachesmalloc/win_heappartition_alloc/address_spaceX"
Source: clearbrowser.exeString found in binary or memory: --help display this help and exit
Source: clearbrowser.exeString found in binary or memory: --help display this help and exit
Source: clearbrowser.exeString found in binary or memory: free-invalid-address
Source: clearbrowser.exeString found in binary or memory: --monitor-self-argument=--monitor-self is not supported--no-identify-client-via-url--no-periodic-tasks--no-rate-limit--no-upload-gzip--monitor-self-annotation=%s=%smetrics-dirannotationattachmentActivityTracker.CollectCrash.Status..\..\components\gwp_asan\crash_handler\crash_handler.ccDetected GWP-ASan crash with missing metadata.Detected GWP-ASan crash for allocation at 0x) of type Invalid address passed to free() is Experienced internal error: partitionallocunexpected allocator typeheap-use-after-freeheap-buffer-underflowheap-buffer-overflowdouble-freefree-invalid-addressunexpected error type:Q
Source: clearbrowser.exeBinary string: HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA\Device\\Device\HarddiskVolume\Device\
Source: classification engineClassification label: sus36.winEXE@3/0@0/0
Source: clearbrowser.exeStatic file information: File size 2360648 > 1048576
Source: clearbrowser.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: clearbrowser.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: clearbrowser.exeStatic PE information: certificate valid
Source: clearbrowser.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x1a8400
Source: clearbrowser.exeStatic PE information: More than 200 imports for KERNEL32.dll
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: clearbrowser.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: clearbrowser.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: chrome.exe.pdb source: clearbrowser.exe
Source: clearbrowser.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: clearbrowser.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: clearbrowser.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: clearbrowser.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: clearbrowser.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D7F1A push rbx; ret 0_2_00007FF6147D7F1C
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D4B3E push rax; retf 0_2_00007FF6147D4B53
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF6147D4B57 push rax; retf 0_2_00007FF6147D4B53
Source: clearbrowser.exeStatic PE information: section name: .00cfg
Source: clearbrowser.exeStatic PE information: section name: .gxfg
Source: clearbrowser.exeStatic PE information: section name: .retplne
Source: clearbrowser.exeStatic PE information: section name: .voltbl
Source: clearbrowser.exeStatic PE information: section name: CPADinfo
Source: clearbrowser.exeStatic PE information: section name: _RDATA
Source: clearbrowser.exeStatic PE information: section name: malloc_h
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\clearbrowser.exeCode function: 0_2_00007FF61493CC34 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF61493CC34

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts2
Command and Scripting Interpreter		Path Interception1
Process Injection		1
Process Injection		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Obfuscated Files or Information		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 791478 Sample: clearbrowser.exe Startdate: 25/01/2023 Architecture: WINDOWS Score: 36 11 Multi AV Scanner detection for submitted file 2->11 5 clearbrowser.exe 2->5         started        7 clearbrowser.exe 2->7         started        9 clearbrowser.exe 2->9         started        process3

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
clearbrowser.exe13%ReversingLabsWin64.PUA.Presenoker
clearbrowser.exe7%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://crashpad.chromium.org/clearbrowser.exefalse
    		high
    https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newclearbrowser.exefalse
      		high
      https://crashpad.chromium.org/bug/newclearbrowser.exefalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox Version:36.0.0 Rainbow Opal
        Analysis ID:791478
        Start date and time:2023-01-25 14:56:40 +01:00
        Joe Sandbox Product:CloudBasic
        Overall analysis duration:0h 3m 24s
        Hypervisor based Inspection enabled:false
        Report type:full
        Sample file name:clearbrowser.exe
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
        Run name:Cmdline fuzzy
        Number of analysed new started processes analysed:3
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • HDC enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Detection:SUS
        Classification:sus36.winEXE@3/0@0/0
        EGA Information:Failed
        HDC Information:
        • Successful, ratio: 100% (good quality ratio 21.2%)
        • Quality average: 11.9%
        • Quality standard deviation: 24.8%
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 8
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Unable to launch sample, stop analysis
        • Corrupt sample or wrongly selected analyzer. Details: C0150002
        • Corrupt sample or wrongly selected analyzer. Details: C0150002
        • Corrupt sample or wrongly selected analyzer. Details: C0150002
        • Execution Graph export aborted for target clearbrowser.exe, PID 712 because there are no executed function

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):6.466691093534333
        TrID:
        • Win64 Executable GUI (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:clearbrowser.exe
        File size:2360648
        MD5:eb2613474de36296e716ceacc646b17c
        SHA1:94525e9da51964c07fcc25e907e400a8589bac5c
        SHA256:fc3c5130d9311ce90835906d842fd7e5e4da00de249a55d1c1832734c2c84dea
        SHA512:c929db651fb502fe228dba530e4b2a8370884b8baf1db0cc1ebf632e435c2ea444839ef42ceadb29a71226d79bb9cff78f683748db9d5402d65d63cce1513437
        SSDEEP:49152:4nUJZ9HvdKrM5CGWd6YyIpPknrJZkR2qBAUrOBW8mKrKy:/TttAyWxu
        TLSH:26B54803E15544E9D299C078CE06D532EB617C5D4BF2A5FB3290BAD62E73AE03B39B11
        File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....N2_.........."..........H...... ..........@.............................0%.......$...`........................................

        File Icon

        Icon Hash:31e0d0c0d0c0e030

        Static PE Info

        General

        Entrypoint:0x14016cc20
        Entrypoint Section:.text
        Digitally signed:true
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
        Time Stamp:0x5F324EA9 [Tue Aug 11 07:54:17 2020 UTC]
        TLS Callbacks:0x400c3c10, 0x1, 0x400d46c0, 0x1, 0x4016b630, 0x1, 0x400f5e90, 0x1
        CLR (.Net) Version:
        OS Version Major:5
        OS Version Minor:2
        File Version Major:5
        File Version Minor:2
        Subsystem Version Major:5
        Subsystem Version Minor:2
        Import Hash:28cc3e1fc363a0f47a1459515ce2d6f1

        Authenticode Signature

        Signature Valid:true
        Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
        Signature Validation Error:The operation completed successfully
        Error Number:0
        Not Before, Not After
        • 3/17/2022 5:00:00 PM 3/22/2023 4:59:59 PM
        Subject Chain
        • CN="Tightrope Interactive, Inc.", O="Tightrope Interactive, Inc.", L=San Francisco, S=California, C=US
        Version:3
        Thumbprint MD5:C7AEA2AB5B6946FA378994299917AA53
        Thumbprint SHA-1:4C6C207DCFA5A3FBC336F8356F951765EB058F05
        Thumbprint SHA-256:5C8949BF3342C342CF080CF2D4D52C08565754B107E3D254E241AFF02A122BF4
        Serial:030601E126B12C53A43E36369308C459
        Instruction
        dec eax
        sub esp, 28h
        call 00007FB5B09B0850h
        dec eax
        add esp, 28h
        jmp 00007FB5B09B06BFh
        int3
        int3
        dec eax
        mov dword ptr [esp+20h], ebx
        push ebp
        dec eax
        mov ebp, esp
        dec eax
        sub esp, 20h
        dec eax
        mov eax, dword ptr [0008E3E0h]
        dec eax
        mov ebx, 2DDFA232h
        cdq
        sub eax, dword ptr [eax]
        add byte ptr [eax+3Bh], cl
        ret
        jne 00007FB5B09B08B6h
        dec eax
        and dword ptr [ebp+18h], 00000000h
        dec eax
        lea ecx, dword ptr [ebp+18h]
        call dword ptr [00082E52h]
        dec eax
        mov eax, dword ptr [ebp+18h]
        dec eax
        mov dword ptr [ebp+10h], eax
        call dword ptr [00082D1Ch]
        mov eax, eax
        dec eax
        xor dword ptr [ebp+10h], eax
        call dword ptr [00082CF8h]
        mov eax, eax
        dec eax
        lea ecx, dword ptr [ebp+20h]
        dec eax
        xor dword ptr [ebp+10h], eax
        call dword ptr [00082F98h]
        mov eax, dword ptr [ebp+20h]
        dec eax
        lea ecx, dword ptr [ebp+10h]
        dec eax
        shl eax, 20h
        dec eax
        xor eax, dword ptr [ebp+20h]
        dec eax
        xor eax, dword ptr [ebp+10h]
        dec eax
        xor eax, ecx
        dec eax
        mov ecx, FFFFFFFFh
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x1eef9d0x8b.rdata
        IMAGE_DIRECTORY_ENTRY_IMPORT0x1ef0280x50.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x22d0000x220c8.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2170000xbc04.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x23dc000x2948.rsrc
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x2500000x21e0.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x1ecac40x38.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x1ec9a80x28.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1aa1600x138.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x1ef7a00x728.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x1ee1900x140.rdata
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x1a82fd0x1a8400False0.4738428568797879data6.577416663862463IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0x1aa0000x50da40x50e00False0.2868286321483771data5.503064427622722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1fb0000x1bea00x10000False0.0388946533203125data1.5645905584563753IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x2170000xbc040xbe00False0.500328947368421data6.030806608566388IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .00cfg0x2230000x280x200False0.0625data0.4285997588138649IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .gxfg0x2240000x2eb00x3000False0.407470703125data5.145141999115951IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .retplne0x2270000x840x200False0.09375data1.2434927268429983
        .tls0x2280000x1c10x200False0.04296875data0.1364637916558982IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .voltbl0x2290000x440x200False0.154296875data1.1423295645151728
        CPADinfo0x22a0000x380x200False0.04296875data0.12227588125913882IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        _RDATA0x22b0000xf40x200False0.314453125data2.4605873927629287IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        malloc_h0x22c0000x6370x800False0.5087890625data5.51355894160577IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rsrc0x22d0000x220c80x22200False0.25440705128205127data4.11254241033308IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0x2500000x21e00x2200False0.28504136029411764data5.447567079474142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountry
        GOOGLEUPDATEAPPLICATIONCOMMANDS0x2408900x4dataEnglishUnited States
        RT_CURSOR0x240d200x134data
        RT_CURSOR0x240e700x134data
        RT_CURSOR0x240fc00x134Targa image data - RLE 64 x 65536 x 1 +32 "\001"
        RT_CURSOR0x2411100x134data
        RT_CURSOR0x2412600x134data
        RT_CURSOR0x2413980xcacdata
        RT_CURSOR0x2420700x134data
        RT_CURSOR0x2421a80xcacdata
        RT_CURSOR0x242e800x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x243f480x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x2450100x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x2460d80x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x2471a00x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x2482680x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x2493300x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x24a3f80x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x24b4c00x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x24c5880x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x24d6500x10acTarga image data 64 x 65536 x 1 +32 " "
        RT_CURSOR0x24e7180x134Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"
        RT_CURSOR0x24e8680x134Targa image data - Mono 64 x 65536 x 1 +32 "\001"
        RT_CURSOR0x24e9b80x134data
        RT_CURSOR0x24eb080x134data
        RT_ICON0x22ddc00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States
        RT_ICON0x22e2280x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States
        RT_ICON0x22ebb00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States
        RT_ICON0x22fc580x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States
        RT_ICON0x2322000x30c8PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
        RT_ICON0x2353180xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States
        RT_ICON0x2361c00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States
        RT_ICON0x236a680x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States
        RT_ICON0x236fd00x7c8PNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States
        RT_ICON0x2377980x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States
        RT_ICON0x239d400x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States
        RT_ICON0x23ade80x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States
        RT_ICON0x23b2b80x4a8Device independent bitmap graphic, 17 x 32 x 32, image size 1088, resolution 2835 x 2835 px/mEnglishUnited States
        RT_ICON0x23b7600x1234Device independent bitmap graphic, 33 x 66 x 32, image size 4356, resolution 2835 x 2835 px/mEnglishUnited States
        RT_ICON0x23c9980x2668Device independent bitmap graphic, 49 x 96 x 32, image size 9408, resolution 2835 x 2835 px/mEnglishUnited States
        RT_ICON0x23f0000x184bPNG image data, 257 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
        RT_GROUP_CURSOR0x240e580x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x240fa80x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2410f80x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2412480x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2420480x22Lotus unknown worksheet or configuration, revision 0x2
        RT_GROUP_CURSOR0x242e580x22Lotus unknown worksheet or configuration, revision 0x2
        RT_GROUP_CURSOR0x243f300x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x244ff80x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2460c00x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2471880x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2482500x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x2493180x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24a3e00x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24b4a80x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24c5700x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24d6380x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24e7000x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24e8500x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24e9a00x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24eaf00x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_CURSOR0x24ec400x14Lotus unknown worksheet or configuration, revision 0x1
        RT_GROUP_ICON0x2352c80x4cdataEnglishUnited States
        RT_GROUP_ICON0x23b2500x68dataEnglishUnited States
        RT_GROUP_ICON0x2408500x3edataEnglishUnited States
        RT_VERSION0x2408980x488dataEnglishUnited States
        RT_MANIFEST0x24ec580x46aXML 1.0 document, ASCII text, with very long lines (1016)EnglishUnited States
        DLLImport
        chrome_elf.dllGetInstallDetailsPayload, IsBrowserProcess, IsExtensionPointDisableSet, SignalChromeElf, SignalInitializeCrashReporting
        KERNEL32.dllAcquireSRWLockExclusive, AssignProcessToJobObject, CloseHandle, CompareStringW, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateIoCompletionPort, CreateJobObjectW, CreateMutexW, CreateNamedPipeW, CreateProcessW, CreateRemoteThread, CreateSemaphoreW, CreateThread, DebugBreak, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DisconnectNamedPipe, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesEx, EnumSystemLocalesW, ExitProcess, ExitThread, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FlushViewOfFile, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumber, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDriveTypeW, GetEnvironmentStringsW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileSizeEx, GetFileTime, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalProcessorInformation, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHandleCount, GetProcessHeap, GetProcessHeaps, GetProcessId, GetProcessTimes, GetProductInfo, GetQueuedCompletionStatus, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultLCID, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadContext, GetThreadId, GetThreadLocale, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLangID, GetUserDefaultLocaleName, GetVersionExW, GetWindowsDirectoryW, HeapDestroy, HeapSetInformation, InitOnceExecuteOnce, InitializeConditionVariable, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeProcThreadAttributeList, InitializeSListHead, InitializeSRWLock, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetPerformanceInfo, K32GetProcessMemoryInfo, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LocalFree, LockFileEx, MapViewOfFile, MoveFileW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PeekNamedPipe, PostQueuedCompletionStatus, QueryDosDeviceW, QueryInformationJobObject, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, RegisterWaitForSingleObject, ReleaseSRWLockExclusive, ReleaseSemaphore, RemoveDirectoryW, ReplaceFileW, ResetEvent, ResumeThread, RtlCaptureContext, RtlCaptureStackBackTrace, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFilePointerEx, SetHandleInformation, SetInformationJobObject, SetLastError, SetNamedPipeHandleState, SetProcessShutdownParameters, SetStdHandle, SetThreadAffinityMask, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableSRW, SleepEx, SuspendThread, SwitchToThread, SystemTimeToTzSpecificLocalTime, TerminateJobObject, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TransactNamedPipe, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnlockFileEx, UnmapViewOfFile, UnregisterWait, UnregisterWaitEx, UpdateProcThreadAttribute, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualFreeEx, VirtualProtect, VirtualProtectEx, VirtualQuery, VirtualQueryEx, WaitForMultipleObjects, WaitForSingleObject, WaitForSingleObjectEx, WaitNamedPipeW, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, Wow64GetThreadContext, WriteConsoleW, WriteFile, WriteProcessMemory, lstrlenW
        VERSION.dllGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
        NameOrdinalAddress
        GetHandleVerifier10x1400c58f0
        GetPakFileHashes20x14003bce0
        IsSandboxedProcess30x1400a2cb0

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        Behavior

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:14:57:34
        Start date:25/01/2023
        Path:C:\Users\user\Desktop\clearbrowser.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\clearbrowser.exe" -install
        Imagebase:0x7ff6147d0000
        File size:2360648 bytes
        MD5 hash:EB2613474DE36296E716CEACC646B17C
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low

        General

        Target ID:1
        Start time:14:57:37
        Start date:25/01/2023
        Path:C:\Users\user\Desktop\clearbrowser.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\clearbrowser.exe" /install
        Imagebase:0x7ff6147d0000
        File size:2360648 bytes
        MD5 hash:EB2613474DE36296E716CEACC646B17C
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low

        General

        Target ID:2
        Start time:14:57:40
        Start date:25/01/2023
        Path:C:\Users\user\Desktop\clearbrowser.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\clearbrowser.exe" /load
        Imagebase:0x7ff6147d0000
        File size:2360648 bytes
        MD5 hash:EB2613474DE36296E716CEACC646B17C
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low

        Disassembly

        Non-executed Functions

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 169d5007a4e51eca8526089c016788fe66a1efd3892f81c36a52d6a5de386cc0
        • Instruction ID: 172ed9f85ee0848bf23315bdc77e4acf9f20f8137f318472642f453605bb1b70
        • Opcode Fuzzy Hash: 169d5007a4e51eca8526089c016788fe66a1efd3892f81c36a52d6a5de386cc0
        • Instruction Fuzzy Hash: 34326AB6F90A6596DB048F16EA4178D7B64F319BD8F898526DF8C83B54EB38E471C300
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 79%
        			E00007FF67FF6147D275E(void* __eax, signed int __ecx, void* __eflags, void* __rax) {

				if (__eflags < 0) goto 0x147d2787;
				_t2 = __rax - 0x75;
				 *_t2 =  *(__rax - 0x75) | __ecx &  *(__rax - 0x75);
				if ( *_t2 == 0) goto 0x147d278c;
				asm("adc bl, dh");
				return __eax;
			}



        0x7ff6147d2761
        0x7ff6147d2763
        0x7ff6147d2763
        0x7ff6147d2766
        0x7ff6147d2768
        0x7ff6147d276a

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: db8a5c00406ef6bb7a62031a6dbce81d12492bbbb5091f91175fcab53591419d
        • Instruction ID: b36eeec333e96ec0005315a38f223a2bb9f60daabaf70eef0c60fa9a57d9489e
        • Opcode Fuzzy Hash: db8a5c00406ef6bb7a62031a6dbce81d12492bbbb5091f91175fcab53591419d
        • Instruction Fuzzy Hash: 47329412D18F9A92E6234739D4031B56710EFB7B98F00E717FFD8B2592DF75A9899200
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1b7633674f7232d67529eeb60fe047a1c9c15b76f84946bdb734799fd101bbff
        • Instruction ID: 7a4ea02cf44201d86f691f0db5a167428b058701f0928c7aebe3563dc92f93cb
        • Opcode Fuzzy Hash: 1b7633674f7232d67529eeb60fe047a1c9c15b76f84946bdb734799fd101bbff
        • Instruction Fuzzy Hash: 16F10312D1CFC583E6254B3996412BA6720FFB6758F01E715EFD922962DF28F2E59200
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4aa21508857e05e73838715149e0d70efa95c697b95d7b1207287b7e7247653a
        • Instruction ID: c1aa35fb397dc2b9d331721ecf340f1dcfef0273b740ec372416a781b5dcb450
        • Opcode Fuzzy Hash: 4aa21508857e05e73838715149e0d70efa95c697b95d7b1207287b7e7247653a
        • Instruction Fuzzy Hash: 02B16E61C2DF8281F7173735449326492349FE3AB4F50CB32FDA9B29A6DF19B68C5120
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 206240b070a8f18d04f3a7bb22e6d580ce9d8d56ce66c1096eab1f7bc1aa5e68
        • Instruction ID: 45ec1234fa2b4c2e4e912884a168e7b5c3b96c11c234ed455aa028f2668c76c4
        • Opcode Fuzzy Hash: 206240b070a8f18d04f3a7bb22e6d580ce9d8d56ce66c1096eab1f7bc1aa5e68
        • Instruction Fuzzy Hash: 2441042EE2CFD761F31383396403632E2005FF7595A81EB2FFCE4B1862AB6453456218
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ef3c0bd79dccf4b915acd6a90ca7f5efba926c63d7852f2c2b15f6ee0e6c3926
        • Instruction ID: 6b9442477649e122f8c1c251ccf8ce87758230b7735e9a640499064599dfec46
        • Opcode Fuzzy Hash: ef3c0bd79dccf4b915acd6a90ca7f5efba926c63d7852f2c2b15f6ee0e6c3926
        • Instruction Fuzzy Hash: 2D31282AC3DFDB91F713873E6407555D614AFF3285A90E32BFAA835822FB119745A304
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ffbfac51568561a3ea02b062807baf878668f5e9efa995e2cdac28f9238f5569
        • Instruction ID: fd44faa1b8f251547bab0c4a0e8e391a3d1abcd0a7b2338ea82ae3b64dab7500
        • Opcode Fuzzy Hash: ffbfac51568561a3ea02b062807baf878668f5e9efa995e2cdac28f9238f5569
        • Instruction Fuzzy Hash: C8315711D39E57C1F6122B38E8822FA97206FA7B34F40D332E9ACB7492EF0C259C6101
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.298449723.00007FF6147D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6147D0000, based on PE: true
        • Associated: 00000000.00000002.298429895.00007FF6147D0000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF61497A000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614982000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298809441.00007FF614992000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149CB000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298845709.00007FF6149DA000.00000008.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149E7000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298856116.00007FF6149F4000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298888220.00007FF6149FB000.00000002.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298894766.00007FF6149FC000.00000020.00000001.01000000.00000003.sdmpDownload File
        • Associated: 00000000.00000002.298899725.00007FF6149FD000.00000002.00000001.01000000.00000003.sdmpDownload File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_7ff6147d0000_clearbrowser.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 67308f6e00fae7ea95a400d7a9ec75fb636c76b12d8955447e382391754f696c
        • Instruction ID: 24a53cc49b334e2dba72a2880899813d1181e71b957be94a4024689f413c01ed
        • Opcode Fuzzy Hash: 67308f6e00fae7ea95a400d7a9ec75fb636c76b12d8955447e382391754f696c
        • Instruction Fuzzy Hash: A321F22AD2DFDB51F613833E6407616D600AFF3685A90E72FF9E835862EB1547806218
        Uniqueness

        Uniqueness Score: -1.00%