meduza | 0b643c870600ffe2c318ff96877508d6907552989aa445e76c1598a46f7c9214

Analysis

max time kernel
124s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Size 79.5MB
Sample240318-sl4mdabf96
SHA256 9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9
MD5 84739feca9702dbbe639e15845a341c6
SHA1 76938a29ed02f9be7f19763e5d84382bb2642dda
SHA512 84b8a7756cdc825ee040e745be5ffa3b8504a4a777e1b85a7b665e84e8601ae492b8c40d6e6e44a09745e4b51010b989a0c8be5242b0b91bd0695cde4a1c58b1
SSDEEP 1572864:ymftwlU3g4NXgBfXUVFVpHy6PvSbJsDKIeiXuoOudA0HleCI/zSlHTKWjX:yIEU1QBfEXbHy+vSbqOjiW0HleCIVWjX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza bootkit discovery persistence spyware stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002336e-358.dat	family_meduza
behavioral2/files/0x000700000002336e-372.dat	family_meduza
behavioral2/files/0x000700000002336e-400.dat	family_meduza

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	CCleaner64.exe
File opened for modification	\??\PhysicalDrive0	CCUpdate.exe
File opened for modification	\??\PhysicalDrive0	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File opened for modification	\??\PhysicalDrive0	CCUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\CCleaner\Lang\lang-1090.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1034.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1050.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1062.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwaheap.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Setup\config.def	CCleaner64.exe
File created	C:\Program Files\CCleaner\Lang\lang-1041.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1042.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1061.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1063.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwautils.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File opened for modification	C:\Program Files\CCleaner	CCleaner64.exe
File created	C:\Program Files\CCleaner\Lang\lang-1031.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1048.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1087.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1110.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwaapi.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\CCleanerBugReport.exe	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\uninst.exe	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1045.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1053.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1102.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Setup\c7cf5d26-3166-487d-ab29-120b0dbd1a6b.dll	CCUpdate.exe
File created	C:\Program Files\CCleaner\Lang\lang-1030.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1040.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1043.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwaresource.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwavmodapi.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Setup\2f6075d9-638f-4270-9ae9-e218c7df8ad3.ini	CCUpdate.exe
File created	C:\Program Files\CCleaner\Lang\lang-1025.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1079.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1092.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-2074.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-5146.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1028.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1054.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1060.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1086.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1104.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-3098.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\CCleanerReactivator.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\CCleaner64.exe	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1052.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1065.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1067.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\libwalocal.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1037.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1032.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1036.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1057.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1066.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1109.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-2052.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1026.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1093.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1046.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1055.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1059.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-1068.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Lang\lang-9999.dll	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
File created	C:\Program Files\CCleaner\Setup\46e9993e-10d1-47e0-8989-ca12f99c4c08.xml	CCUpdate.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\CCleanerCrashReporting.job	CCleaner64.exe
File opened for modification	C:\Windows\Tasks\CCleanerCrashReporting.job	CCleaner64.exe

Executes dropped EXE 5 IoCs

pid	Process
1596	CCleaner64.exe
4400	CCUpdate.exe
3792	CCUpdate.exe
836	wa_3rd_party_host_64.exe
924	wa_3rd_party_host_64.exe

Loads dropped DLL 17 IoCs

pid	Process
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
3792	CCUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CCleaner64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CCleaner64.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\CCleaner\Brandover = "0"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\CCleaner\AcqSrc = "mmm_ccl_003_999_a8c_m"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\CCleaner\AutoICS = "1"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\.DEFAULT	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Piriform\CCleaner\AutoICS = "1"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Piriform\CCleaner\AcqSrc = "mmm_ccl_003_999_a8c_m"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-20	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\CCleaner\Brandover = "0"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Piriform	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Piriform\CCleaner\Brandover = "0"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\CCleaner\AutoICS = "1"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-19	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\CCleaner\AcqSrc = "mmm_ccl_003_999_a8c_m"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Run CCleaner\command\ = "C:\\Program Files\\CCleaner\\ccleaner.exe /AUTORB"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\URL Protocol	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell\	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Run CCleaner\command	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Open CCleaner...\command	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell\open\	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Open CCleaner...	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software\Piriform\CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software\Piriform\CCleaner\Brandover = "0"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software\Piriform\CCleaner\AcqSrc = "mmm_ccl_003_999_a8c_m"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\ = "URL: CCleaner Protocol"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software\Piriform\CCleaner\AutoICS = "1"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Open CCleaner...\command	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell\open	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell\open\command\ = "\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /%1"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Run CCleaner	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Open CCleaner...\command\ = "C:\\Program Files\\CCleaner\\ccleaner.exe /FRB"	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cclaunch\shell\open\command	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Run CCleaner\command	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Software\Piriform	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe
1596	CCleaner64.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Token: SeCreatePagefilePrivilege	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Token: SeShutdownPrivilege	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Token: SeCreatePagefilePrivilege	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Token: SeRestorePrivilege	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
Token: SeDebugPrivilege	1596	CCleaner64.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1596	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe	103
PID 4060 wrote to memory of 1596	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe	103
PID 4060 wrote to memory of 4400	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe	105
PID 4060 wrote to memory of 4400	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe	105
PID 4060 wrote to memory of 4400	4060	9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe	105
PID 4400 wrote to memory of 3792	4400	CCUpdate.exe	106
PID 4400 wrote to memory of 3792	4400	CCUpdate.exe	106
PID 4400 wrote to memory of 3792	4400	CCUpdate.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe
"C:\Users\Admin\AppData\Local\Temp\9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in Program Files directory
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files\CCleaner\CCleaner64.exe
  "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Program Files\CCleaner\CCUpdate.exe
  "C:\Program Files\CCleaner\CCUpdate.exe" /reg
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Program Files\CCleaner\CCUpdate.exe
    CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\c7cf5d26-3166-487d-ab29-120b0dbd1a6b.dll"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4416

C:\Program Files\CCleaner\wa_3rd_party_host_64.exe
"C:\Program Files\CCleaner\wa_3rd_party_host_64.exe"
1⤵
- Executes dropped EXE
PID:836

C:\Program Files\CCleaner\wa_3rd_party_host_64.exe
"C:\Program Files\CCleaner\wa_3rd_party_host_64.exe"
1⤵
- Executes dropped EXE
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CCUpdate.exe

Path C:\Program Files\CCleaner\CCUpdate.exe
Size 697KB
SHA256 4ad9635351c8e8579c4d4c2bdd679ea7b135ec329adc6fd5d8211255e2e666be
MD5 0f0b90a01f049665ca511335f9f0bf2e
SHA1 baf4016e50050b24925437864bfb3c19d0baa901
SHA512 44da936d020e857bf3bfa2bcc7a91182da9c1f320fe041bb2836d4e8ae99d4b939ea27842b49b9a2cd24e09c7698579617584d431a2b2f7eafdafa1fb9a59c50
SSDEEP 12288:VBkGdCMw6KJx17OeNg086YN/ggggMDMCy/VmuqLZeviFGQ2mfzAuEUVoFY:VBkeFw62+ggggMvGmev/6ZEUVoFY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCleaner.exe

Path C:\Program Files\CCleaner\CCleaner.exe
Size 18.1MB
SHA256 351532b7a482cfa85e964ff2f6fe424a158d74a294a762fd4bbc09d18192ee99
MD5 69b236c373e8c5b3fb46e954249e2067
SHA1 0c4b680204a4b95e7bb740857bde71f5235369aa
SHA512 76af541aa6493407274dbba1db5de41943a44a591cafd9ab7b4cdae118a65e72709a79fe42dedccf3ed74e25bad521cb582f7a5bbae894e1548073102ca06458
SSDEEP 393216:DWzoOi7j8QrFh5PenSLYK3TkxckvqwjSOiZgVk:QoOyjvrFhNDLYKkDjSOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCleaner64.exe

Path C:\Program Files\CCleaner\CCleaner64.exe
Size 30.4MB
SHA256 0034d086b5189e2bf8836d185b50fb3df5b636c31f58b9c8e537251687b95e90
MD5 a580e52246d337feabe5a6876f92e32d
SHA1 e22da90bd577a09421e56ddf8235f41a302947dc
SHA512 99fba51399e610e9a8be4b77d7cc3e609edaad14469793f97c5df0f7f5a206aafc5c93e400a66e1edc68ea121d323cd775269662462a4454aae29389b75d3649
SSDEEP 393216:73/9Y5+7Smeh18mBTis2f17M1pv90E3tEFbhrqNn:7PQ+wd9+7S0EF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCleaner64.exe

Path C:\Program Files\CCleaner\CCleaner64.exe
Size 19.3MB
SHA256 84a1659364fbf731ce934d31df4b3537e1783a0cddff9dbe72c34adb7daaa6e0
MD5 addc1dc1f2668524747d6de6b02abba6
SHA1 7cdc35befe676edeb10cf5d7bc49dce29cd3ea32
SHA512 74d82643b26ccebcf799d56e486e713351435f7dd4d4ab7c4a9cf1836bcecb11971d5ecdaf7c99530918a676187b8b0a4ae1074cd638dc0ffffd38669f73456e
SSDEEP 196608:73/9Y7Z+hG+7M2IfmfWh18mBTihW2eRwACPTyuN6:73/9Y5+7Smeh18mBTis2f17+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCleaner64.exe

Path C:\Program Files\CCleaner\CCleaner64.exe
Size 15.2MB
SHA256 85d65e7c1b6b7b2fa186d28678e99169a5573e0a90bf2f76b9c4ed44f29a6ad3
MD5 8cd50333cffe603b7bf0f400fe777205
SHA1 cb5b34ea96097b8f90daa97a91e3ed858580585a
SHA512 46d32102bcf21de152dd5b1801557a5802a968ad0ec91d4e5f35f21400cff180c1ca356ebee9a58ee8f3561247b6134b1460ec3534720b3ac9e3476f5ee60bba
SSDEEP 196608:73/9Y7Z+hG+7M2IfmfWh18mBTihW2eRw2:73/9Y5+7Smeh18mBTis2f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f6075d9-638f-4270-9ae9-e218c7df8ad3.ini

Path C:\Program Files\CCleaner\Setup\2f6075d9-638f-4270-9ae9-e218c7df8ad3.ini
Size 170B
SHA256 473d48a44a348f6c547aefd2c60dd4b9de0092e1fb94a7611bdd374783ef3b2c
MD5 2af9f69df769f876f6e02da18e966020
SHA1 5d21312d9bd23a498a294844778c49641a63d5e2
SHA512 a4705e5491cf03867fd46e63293181bf761d04fe0cccb86e373dd567c68d646634f64ef95d5b910d2266468b93bf7cdf6f9acbf576c6f42a4ff6c3caa09d2274
MD5 SHA1 SHA512

Submit Download

46e9993e-10d1-47e0-8989-ca12f99c4c08.xml

Path C:\Program Files\CCleaner\Setup\46e9993e-10d1-47e0-8989-ca12f99c4c08.xml
Size 818B
SHA256 abdfc16e71bd74863dbb57bf138a92cb05f8e2fe4f297838b2d38b014a06c882
MD5 47140876852d8ece2d6e48dcebe31169
SHA1 41b349626a84b2b7a95ce5bce11ab55c5617699c
SHA512 7209b042d6b17c6fa76533debf6690a8108777b95a12f70dfd42fbf9114a93c50af185af77aedfee83a525c2fe5f8b2c0ce59dc4f9160bda2f42dff1c59fb0b3
MD5 SHA1 SHA512

Submit Download

c7cf5d26-3166-487d-ab29-120b0dbd1a6b.dll

Path C:\Program Files\CCleaner\Setup\c7cf5d26-3166-487d-ab29-120b0dbd1a6b.dll
Size 469KB
SHA256 c427bcf6b065edf06662e0540e3e9a21c07095184e7bb9d05926dc3b79fc3348
MD5 fe6f58fb55d9a93502528c3c9bb13a3f
SHA1 516275dddbc9e2f056342201b03a0931d93a6239
SHA512 7f45f187d6c3156b89e2daf0c2bfdc60a59140ff94f8255fa672422abc43aa1252b0fe0fa0a3ef675f9e71c33b26424597c015db83dec7f5e20ee8769c61c619
SSDEEP 12288:KptzeTYZP443n/q6LQX5uNllmSJIbbEcgSZ5MQUszT:KptzeKP443nCuQKgSJITgybUsf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wa_3rd_party_host_64.exe

Path C:\Program Files\CCleaner\wa_3rd_party_host_64.exe
Size 2.7MB
SHA256 5dd6788e60b475b092436ec33df48590d367216fbf709ba56d51519c2ef00e30
MD5 7bd30e055bb2fc492b3e863fc5f59655
SHA1 332d134473bcac3735eb6fecd605621dd3d2a297
SHA512 22eb821cad54fa1cbba95add4a3cc2c5f1e227ce9c671933ef2b25f8ab5c9e07476e212e734e42276feaf41bcf6821e6fdf0dc7cfe69d916501ceb4319ea6ac7
SSDEEP 49152:LU762rGD/RTRTue0Kpk6TIockdwFzAzmUM4H5l0k8tz:47RmnunQazOmorrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

V01.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
Size 512KB
SHA256 71cc2b3a272f82381778ef3b2ae188d42da5a450b6cbef4530b46252c1c3aa7c
MD5 5cf9179d7d92639899a3e64b32310d60
SHA1 0acf192ca42c5f337bebe9e1b68f159355257380
SHA512 8b4591eba8a1e0d7c58cf76056a479e07207dbaefe33981e7d7a1c8bb0358f062f1163d56cf6ce3b4456d5cfc102937fabd5cc42de09604656dbae7f0139b3a0
SSDEEP 3072:rUmboyDj+ZrVeuyDEXYtkj/UbG12GWyI+jxWr/wGzoUegwljE85Q4DI/6ENY/M:Pb/msDEXl1fjQ14E
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebCacheV01.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
Size 14.0MB
SHA256 3a4c7b839d44897ce96ffb00d495d82da5a7aa98e8416264ce4ef497a216b5a4
MD5 bfbddad4fe2694745954d5f00a4cfd32
SHA1 f7e41335e499e791dff232570c690f17244d257e
SHA512 13d5fa2e9b907f6978c867945457f9c13f52dde2edc7b396c55ac8d48a2665e9659c637bba73270f737afd0e5f7058be2ecd315260b61bc4c1ba3aabd06ca434
SSDEEP 6144:u34To4MtCPQj5ULDEXhU4iSfsbiPIpGkDqvdfvduZyGczLFL0uA3VA:u38owPcUSdnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebCacheV01.jfm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm
Size 16KB
SHA256 e40cb3252e28fa7963138285b2344692fb613aefb934966056eee1971cff4862
MD5 00f8580339561f5fa6bc55e2e0dc3bcd
SHA1 ca1f7ce51f2f42782ed3d731bfce6b28b7e861e6
SHA512 bf657196511ee335ae86a20aaa1e78aa2bd3379cc387aba3d4815d409b7c28f206706f75e0fc7bd906eac1548dd769413e9cfe755c078660f66bfbb0f68ac79e
SSDEEP 3:co//N3WZQFFW1Mup1qejyVZjllehw6lllllxRllsQlx8e5mRn/lfzdlnl9nQ/llS:coN3WBqiA8iOllbllZaDB9f1X
MD5 SHA1 SHA512 SSDEEP

Submit Download

aswd8625ee1131ff60a.tmp

Path C:\Users\Admin\AppData\Local\Temp\aswd8625ee1131ff60a.tmp
Size 35B
SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
MD5 28d6814f309ea289f847c69cf91194c6
SHA1 0f4e929dd5bb2564f7ab9c76338e04e292a42ace
SHA512 1d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c
MD5 SHA1 SHA512

Submit Download

ButtonEvent.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\ButtonEvent.dll
Size 5KB
SHA256 e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d
MD5 c24568a3b0d7c8d7761e684eb77252b5
SHA1 66db7f147cbc2309d8d78fdce54660041acbc60d
SHA512 5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443
SSDEEP 48:a7sTTDi+BjvqYR4gYFmsHFpXq65lZ9W5wOXnhLk4nOvlWxG5PZKuB:ri+BjSXgY8sHFE6TzWXzncsGSm
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\INetC.dll
Size 23KB
SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
MD5 7760daf1b6a7f13f06b25b5a09137ca1
SHA1 cc5a98ea3aa582de5428c819731e1faeccfcf33a
SHA512 d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
SSDEEP 384:l4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO:lG8sUAUnt88CFJDhmajMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\UserInfo.dll
Size 4KB
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
MD5 SHA1 SHA512

Submit Download

asdk.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\a\asdk.dll
Size 1.0MB
SHA256 74fcd2367fb1d9c0084547ebaf1c6db081946453a5d0a2d668d83d3c489a60a9
MD5 e3f60a2cf6b1d155f5f7d17615907013
SHA1 8191871854dcbcc4fe34218040215581b0fccf43
SHA512 20a57a1d2ce3d081958b4b3b48f1c902039f26dd28abcac94fad6f20e8e5d630bbfd2365eb7200f7c8d676c593cb3dc465a406e8536abdf63bd7ef76bb86df2b
SSDEEP 12288:U/TjOExADWCIvLhqBHp0ZdGXSfScVggggMu7QNb+a/aoV4Vax1gIzKLORnf68LjN:KqExXWfCPggggMuOZaoVyaxoLOY83
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcapi_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\g\gcapi_dll.dll
Size 348KB
SHA256 d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
MD5 2973af8515effd0a3bfc7a43b03b3fcc
SHA1 4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA512 b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e
SSDEEP 6144:O3RIclFikwwYUP5SvL8z6uNMw4n8kUddV6F8Q4cfRUWj/aNTcES:O36SwwviL8VgnaddV6F8Q4cZBzES
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServiceUninstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\p\ServiceUninstaller.dll
Size 497KB
SHA256 0b78d56aceefb4ff259660bd55bbb497ce29a5d60206b5d19d05e1442829e495
MD5 3053907a25371c3ed0c5447d9862b594
SHA1 f39f0363886bb06cb1c427db983bd6da44c01194
SHA512 226530658b3e1530f93285962e6b97d61f54039c1bbfcbc5ec27e9ba1489864aecd2d5b58577c8a9d7b25595a03aa35ee97cc7e33e026a89cbf5d470aa65c3e8
SSDEEP 12288:Iuxv89zhwE04WSrOzqCxHoRNR4DdjuJjQn6nPOy:ZJ5SrOzqCZxDdjuVe6nPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfBL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\p\pfBL.dll
Size 7.8MB
SHA256 1da78fe5f0d9f7213555e4f9598515d458d22b78f1c98ab3f3f4ae82fe634663
MD5 4b8fe6a142e21de2690281371f5330a1
SHA1 0b16d5b636dccfc28c6d244c6dc055fd8eaebc19
SHA512 dcf555228f760f69196d5ded40a7153c9344152c3aab3e5368f57b556f35b8b3f2406b9f65e2811c2e8722aa0c65cc281f3236b10c86051cae03932f9e4d1b09
SSDEEP 98304:nd5//EV/hocUeQT0XYQrs4IzIy7dArwyhwOCbPMdLau04:nbhTEJIzI6dArvhiPXu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfUI.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\ui\pfUI.dll
Size 18.1MB
SHA256 92a3d60fce2dae1d649721d1fa4679005fd8e8bcbf386718749d75b928ca3123
MD5 83258c10f17f80f47ac3c036f3598e8a
SHA1 064cf7b83580979dff279adff2b83fdf172f8b07
SHA512 b24b85a4f3984c76b79e71130456c1ac2cd1257190d8deca63ef801882a9420cfe68cc361fb9068203469fc2b7d56f9135a0d47efc9746024eb264f48b891f4c
SSDEEP 196608:D6827i8XCrYfOgiYMqPUdh2Y24s076B0gVo3dGzw+TEVcagQ:D07i8X/mgiYr8dh2Y24s07Im4w+AhL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CC_Logo_40x96.png

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\ui\res\CC_Logo_40x96.png
Size 2KB
SHA256 b013039e32d2f8e54cfebdbfdabc25f21aa0bbe9ef26a2a5319a20024961e9a7
MD5 d32b0460183056d3056d6db89c992b88
SHA1 79823e151b3438ab8d273a6b4a3d56a9571379b4
SHA512 3ad36f9d4015f2d3d5bc15eac221a0ecef3fcb1ef4c3c87b97b3413a66faa445869e054f7252cc233cd2bf8f1aa75cb3351d2c70c8121f4850b3db29951bc817
MD5 SHA1 SHA512

Submit Download

CC_logo_72x66.png

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\ui\res\CC_logo_72x66.png
Size 7KB
SHA256 58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f
MD5 a736159759a56c29575e49cb2a51f2b3
SHA1 b1594bbca4358886d25c3a1bc662d87c913318cb
SHA512 4da523a36375b37fa7bc4b4ccf7c93e1df7b2da15152edf7d419927aa1bb271ef8ba27fe734d2f623fcc02b47319e75333df014bed01eb466e0cd9ec4111ef53
SSDEEP 192:SCVcCARPBHZUeIIPY6ZGH5AESYAsMTwtDhAMq:SlRJ5UeII7wEBJTwSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

PF_computer.png

Path C:\Users\Admin\AppData\Local\Temp\nsc4066.tmp\ui\res\PF_computer.png
Size 87KB
SHA256 dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b
MD5 7f4f45c9393a0664d9d0725a2ff42c6b
SHA1 b7b30eb534e6dc69e8e293443c157134569e8ce7
SHA512 0c27f9ce615cbff3e17fd772ce3929ab4419d7432d96223b7eec1ba70953f2ac993404b954020247b52d7f7499212d44eb6f85da2e2676773cafe1ce89b390f9
SSDEEP 1536:jU6vVsf6Z/r1EJ8yIfDnA2RBjY85YGmr/OOykkT/Ee+liGIQbTZpVa1bUyYgUSF3:jU8GfwhI8Zr/R5B5YfbOfp76liGD9pV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4060-119-0x0000000006AD0000-0x0000000006AE0000-memory.dmp

Download

memory/4060-227-0x0000000007A90000-0x0000000007A91000-memory.dmp

Download

memory/4060-224-0x0000000007CF0000-0x0000000007CF8000-memory.dmp

Download

memory/4060-221-0x0000000007C70000-0x0000000007C78000-memory.dmp

Download

memory/4060-175-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/4060-171-0x0000000007A80000-0x0000000007A81000-memory.dmp

Download

memory/4060-168-0x0000000007B70000-0x0000000007B78000-memory.dmp

Download

memory/4060-166-0x0000000007B30000-0x0000000007B38000-memory.dmp

Download

memory/4060-154-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/4060-151-0x0000000007A80000-0x0000000007A88000-memory.dmp

Download

memory/4060-148-0x0000000007A90000-0x0000000007A98000-memory.dmp

Download

memory/4060-146-0x0000000007A80000-0x0000000007A81000-memory.dmp

Download

memory/4060-145-0x0000000007A90000-0x0000000007A98000-memory.dmp

Download

memory/4060-143-0x0000000007CF0000-0x0000000007CF8000-memory.dmp

Download

memory/4060-125-0x0000000006D60000-0x0000000006D70000-memory.dmp

Download