Overview

overview

7

Static

static

3

ccsetup626pro.exe

windows11-21h2-x64

7

$PLUGINSDIR/INetC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$_115_/lang-1025.dll

windows11-21h2-x64

1

$_115_/lang-1026.dll

windows11-21h2-x64

1

$_115_/lang-1027.dll

windows11-21h2-x64

1

$_115_/lang-1028.dll

windows11-21h2-x64

1

$_115_/lang-1029.dll

windows11-21h2-x64

1

$_115_/lang-1030.dll

windows11-21h2-x64

1

$_115_/lang-1031.dll

windows11-21h2-x64

1

$_115_/lang-1032.dll

windows11-21h2-x64

1

$_115_/lang-1034.dll

windows11-21h2-x64

1

CCUpdate.exe

windows11-21h2-x64

6

CCleaner.exe

windows11-21h2-x64

6

CCleaner64.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    95s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/08/2024, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ccsetup626pro.exe
  • Size 72.2MB
  • Sample240814-eb3qfawdnd
  • SHA256 ebd3bc74866f6cd818141da0ff7ae51b4b1970dad1695f3f57845909f9c7b7a4
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoverypersistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Downloads MZ/PE file
  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 18 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccsetup626pro.exe
    "C:\Users\Admin\AppData\Local\Temp\ccsetup626pro.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Program Files\CCleaner\CCleaner64.exe
      "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3524
    • C:\Program Files\CCleaner\CCUpdate.exe
      "C:\Program Files\CCleaner\CCUpdate.exe" /reg
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Program Files\CCleaner\CCUpdate.exe
        CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\70c9b85f-bf47-4af2-8b76-0b93b460c24b.dll"
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5188
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=3
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa51203cb8,0x7ffa51203cc8,0x7ffa51203cd8
        3⤵
          PID:2452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
          3⤵
            PID:4024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
            3⤵
              PID:4592
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
              3⤵
                PID:3264
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
                3⤵
                  PID:244
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
                  3⤵
                    PID:4476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
                    3⤵
                      PID:5352
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1330511639565632459,14641089765873982967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                      3⤵
                        PID:5204
                    • C:\Program Files\CCleaner\CCleaner64.exe
                      "C:\Program Files\CCleaner\CCleaner64.exe"
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      • Drops file in Program Files directory
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:5360
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:5480
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:1788
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:5764
                      • C:\Windows\system32\werfault.exe
                        werfault.exe /h /shared Global\6d9beeac63954009b2cc3d09f6185d83 /t 2704 /p 5360
                        1⤵
                          PID:3868

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              CCUpdate.exe
                              • Path C:\Program Files\CCleaner\CCUpdate.exe
                              • Size 809KB
                              • SHA256 e531742a357907248de84b99f68ed7e8edd70e7ca918d21b24cc17ee4c128240
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              CCleaner.exe
                              • Path C:\Program Files\CCleaner\CCleaner.exe
                              • Size 37.1MB
                              • SHA256 9cea0bdcf677382833e973158a0c7c9b5dee86fbd7c6fdb8b114aa7b23e64d58
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              CCleaner64.exe
                              • Path C:\Program Files\CCleaner\CCleaner64.exe
                              • Size 42.9MB
                              • SHA256 c02731acaa708f929e4935da2338cda307afb4729c962722708e5a4e3b8aeb33
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              253a35ed-e3f1-4e9e-9628-68e736ecace2.ini
                              • Path C:\Program Files\CCleaner\Setup\253a35ed-e3f1-4e9e-9628-68e736ecace2.ini
                              • Size 170B
                              • SHA256 473d48a44a348f6c547aefd2c60dd4b9de0092e1fb94a7611bdd374783ef3b2c
                              • MD5 SHA1 SHA512
                              Submit Download

                              70c9b85f-bf47-4af2-8b76-0b93b460c24b.dll
                              • Path C:\Program Files\CCleaner\Setup\70c9b85f-bf47-4af2-8b76-0b93b460c24b.dll
                              • Size 469KB
                              • SHA256 c427bcf6b065edf06662e0540e3e9a21c07095184e7bb9d05926dc3b79fc3348
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              959a9ad0-8f14-4d55-9ad5-052cd6f713fb.xml
                              • Path C:\Program Files\CCleaner\Setup\959a9ad0-8f14-4d55-9ad5-052cd6f713fb.xml
                              • Size 818B
                              • SHA256 6670a81a48ea5c942c3617f0cfa026352adfa1a9bcbb7848f4c41ea427585ff0
                              • MD5 SHA1 SHA512
                              Submit Download

                              config.def
                              • Path C:\Program Files\CCleaner\Setup\config.def
                              • Size 27B
                              • SHA256 09c65b39bc891e12956ab7bb30fae147ef7c8fa37542b6f040613436b566e7f8
                              • MD5 SHA1 SHA512
                              Submit Download

                              branding.dll
                              • Path C:\Program Files\CCleaner\branding.dll
                              • Size 50KB
                              • SHA256 3289901e88e38e1a9dec202e7a731d1fadf16855349a394d046107aa40c93d84
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              05DDC6AA91765AACACDB0A5F96DF8199
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
                              • Size 854B
                              • SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
                              • MD5 SHA1 SHA512
                              Submit Download

                              24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                              • Size 1KB
                              • SHA256 eb0cadc23ef08f1d6e2e2506f3a4cb1bb50cb5d06e6eca1528a7cf84a34cbfb7
                              • MD5 SHA1 SHA512
                              Submit Download

                              B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              • Size 471B
                              • SHA256 86c27af92621e3c2d2073d2845353a870432ccbfc34c69250d51ee7301d0d4c3
                              • MD5 SHA1 SHA512
                              Submit Download

                              05DDC6AA91765AACACDB0A5F96DF8199
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
                              • Size 170B
                              • SHA256 07c006da67cd466b4347b877a831c145bcfa09672bf1ba9182abede717bade42
                              • MD5 SHA1 SHA512
                              Submit Download

                              24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                              • Size 410B
                              • SHA256 bc38bfb9b8c6364a6e5f6fbeca7f2466a0e1a4cab2fc3c746501fcc530925539
                              • MD5 SHA1 SHA512
                              Submit Download

                              B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              • Size 400B
                              • SHA256 efc0365c8265f262cefeb27c4a85f9a55118ef89d58e3e88ef87eaaa037bd089
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 152B
                              • SHA256 d9589878daebff7c0991b2007a7af982f4760512545b4e331708f3f3308447ac
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              • Size 152B
                              • SHA256 8d59014ec29aebf56b641a018b29b6c64e33764d7a2262283ce51319071f930c
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                              • Size 480B
                              • SHA256 bf2eed5f0cc111d4abc26f8bbb95b0d2bcdef9114a300894580e81acd6643b60
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                              • Size 2KB
                              • SHA256 8c23565d8fd73bbac510623a8994bd94b6e055a9e03688a85c921a8dfbb196df
                              • MD5 SHA1 SHA512
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              • Size 7KB
                              • SHA256 12df37dc972bf21e8deff5ccd65b971a69843b65f9e90b2c466de4c116610117
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              • Size 5KB
                              • SHA256 1b2c06c8dceec0de6bb9fc7ae13903acd0a6bce718204ac468801c28926fa65c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Secure Preferences
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                              • Size 25KB
                              • SHA256 c5f1bd264450e4e5abbc92baa64264e8621ffc3dc7ffe360145958651635b186
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              • Size 10KB
                              • SHA256 53d75d5a34e2bedbd600613f46afaa12c0781969d8bbbac39fc756bccb6c2cc3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              V01.log
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
                              • Size 512KB
                              • SHA256 d16fa132a8627979127917ecd285636a2d1cec4b4684e7686e72ae1b141f8c97
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WebCacheV01.dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
                              • Size 14.0MB
                              • SHA256 4c0af43708d708c0e87451a510bc423aaedd5fc1947679e3096c2f59910da34c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              SearchHoverUnifiedTileModelCache.dat
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                              • Size 10KB
                              • SHA256 66756c0edf3925de7bcb685385e2a4f0b854cffd796a9e90eb1ed064b1fb0e30
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              aswb17427cc941ed194.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\aswb17427cc941ed194.tmp
                              • Size 35B
                              • SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
                              • MD5 SHA1 SHA512
                              Submit Download

                              ButtonEvent.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\ButtonEvent.dll
                              • Size 5KB
                              • SHA256 e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              INetC.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\INetC.dll
                              • Size 23KB
                              • SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              System.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\System.dll
                              • Size 12KB
                              • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              UserInfo.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\UserInfo.dll
                              • Size 4KB
                              • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
                              • MD5 SHA1 SHA512
                              Submit Download

                              nsDialogs.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\nsDialogs.dll
                              • Size 9KB
                              • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              nsProcess.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\nsProcess.dll
                              • Size 4KB
                              • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              ServiceUninstaller.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\p\ServiceUninstaller.dll
                              • Size 497KB
                              • SHA256 0b78d56aceefb4ff259660bd55bbb497ce29a5d60206b5d19d05e1442829e495
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              pfBL.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\p\pfBL.dll
                              • Size 6.0MB
                              • SHA256 aac187b6ca8256f90f64d940cbd9aa457f3b52229cca5bb17d5ec4ac3f8993c4
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              pfUI.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\ui\pfUI.dll
                              • Size 10.4MB
                              • SHA256 d5743d79630a56e3a84baf601c26f2744f3c9d1ccfe1649e8f6fe4a75ca8b309
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              CC_Logo_40x96.png
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\ui\res\CC_Logo_40x96.png
                              • Size 2KB
                              • SHA256 b013039e32d2f8e54cfebdbfdabc25f21aa0bbe9ef26a2a5319a20024961e9a7
                              • MD5 SHA1 SHA512
                              Submit Download

                              CC_logo_72x66.png
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\ui\res\CC_logo_72x66.png
                              • Size 7KB
                              • SHA256 58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              PF_computer.png
                              • Path C:\Users\Admin\AppData\Local\Temp\nseC3A0.tmp\ui\res\PF_computer.png
                              • Size 87KB
                              • SHA256 dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              CCleanerCrashReporting.job
                              • Path C:\Windows\Tasks\CCleanerCrashReporting.job
                              • Size 666B
                              • SHA256 f4441d0cd101e9959d1cb71fd03af45726b205eb8e497f856e27a1f3a0472ddc
                              • MD5 SHA1 SHA512
                              Submit Download

                              memory/3004-164-0x0000000007BB0000-0x0000000007BB8000-memory.dmp
                              Download

                              memory/3004-148-0x0000000007B70000-0x0000000007B71000-memory.dmp
                              Download

                              memory/3004-145-0x0000000007E00000-0x0000000007E08000-memory.dmp
                              Download

                              memory/3004-121-0x0000000006D40000-0x0000000006D50000-memory.dmp
                              Download

                              memory/3004-113-0x0000000006B80000-0x0000000006B90000-memory.dmp
                              Download

                              memory/3004-150-0x0000000007B80000-0x0000000007B88000-memory.dmp
                              Download

                              memory/3004-147-0x0000000007B80000-0x0000000007B88000-memory.dmp
                              Download

                              memory/3004-153-0x0000000007B70000-0x0000000007B78000-memory.dmp
                              Download

                              memory/3004-156-0x0000000007B30000-0x0000000007B31000-memory.dmp
                              Download

                              memory/3004-166-0x0000000007C90000-0x0000000007C98000-memory.dmp
                              Download

                              memory/3004-169-0x0000000007B70000-0x0000000007B71000-memory.dmp
                              Download

                              memory/3004-173-0x0000000007B30000-0x0000000007B31000-memory.dmp
                              Download