Overview

overview

10

Static

static

3

CCleaner-Crack.exe

windows10-2004-x64

10

CCleaner-Crack.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/05/2025, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CCleaner-Crack.exe
  • Size 60.2MB
  • Sample250503-rbbceatxay
  • SHA256 ffb8cffd028a5cec524d366602d1513b6e7d43b36a86169547b70f8babf62c21
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bootkitdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\handler.bat

Ransom Note
  • @echo off taskkill /f /im explorer.exe >nul color 0a title InjectLocker Ransomware echo Your files have been encrypted using a professional encryption. echo For decryption solutions, visit https://my.cbox.ws/d3cryption and ask us how to decrypt. echo tl;dr: your files were encrypted by InjectLock Team echo And also, I don't care if you work at a big company. pause >nul pause >nul pause >nul
URLs

  • https://my.cbox.ws/d3cryption

Signatures

  • Drops startup file 3 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks system information in the registry 2 TTPs 4 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Windows directory 32 IoCs
  • Embeds OpenSSL 3 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\CCleaner-Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\CCleaner-Crack.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\ccl.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3328
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner.exe
        ccleaner.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe
          ccleaner.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks for any installed AV software in registry
          • Writes to the Master Boot Record (MBR)
          • Checks system information in the registry
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4592
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe" /monitor
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks for any installed AV software in registry
            • Writes to the Master Boot Record (MBR)
            • Checks system information in the registry
            • Drops file in Windows directory
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:900
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wa_3rd_party_host_32.exe
            --pid=4592
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:388
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\handler.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1736
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im explorer.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1096
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wa_3rd_party_host_64.exe
            --pid=4592
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3784
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\handler.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im explorer.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:464
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wa_3rd_party_host_64.exe
            --pid=4592
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\handler.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4720
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im explorer.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5396
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe" /MONITOR
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5176
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe
      C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe /MONITOR
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in Windows directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5764
  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerPerformanceOptimizerService.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerPerformanceOptimizerService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:3576
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4276

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          5
          T1012

          Software Discovery

          1
          T1518

          Security Software Discovery

          1
          T1518.001

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          4DC8345FDF8D86D4399FFC8D381ED33C_0AB70F6CFEA35708144C81E18E62883E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DC8345FDF8D86D4399FFC8D381ED33C_0AB70F6CFEA35708144C81E18E62883E
          • Size 472B
          • SHA256 d6ce57dc42687042b732974e28162851f69238d62293669ccc29b328a848f526
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 471B
          • SHA256 17ddabac885b3461b5e2d45e1b22ead08ec542625227cfb55bc5836f9b906ef3
          • MD5 SHA1 SHA512
          Submit Download

          E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
          • Size 471B
          • SHA256 6e032c7b927958a94da113b2d04e85e2471202477dc6dce920c2af696f3e07d6
          • MD5 SHA1 SHA512
          Submit Download

          4DC8345FDF8D86D4399FFC8D381ED33C_0AB70F6CFEA35708144C81E18E62883E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DC8345FDF8D86D4399FFC8D381ED33C_0AB70F6CFEA35708144C81E18E62883E
          • Size 410B
          • SHA256 dc63a665734060aa99c30abdd190e41950a987334bb6b4347b62d91bcbe278fd
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 400B
          • SHA256 a4ab2fe6c8a38ebbb7727f32a5e4236cbe7f8841e4094f8e96ebf9790dc86a05
          • MD5 SHA1 SHA512
          Submit Download

          E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
          • Size 404B
          • SHA256 51c6d701ca38fe6e65ab3e03251be5cc737ce4ce1d165e477c4e4e537f653979
          • MD5 SHA1 SHA512
          Submit Download

          V01.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
          • Size 512KB
          • SHA256 9ddc6a8f91327b6fe570a7ffcefa2ccefd28fe84eff4fecf8f3815a01bb8112d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          V01.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
          • Size 512KB
          • SHA256 0360a0a9f92061ff30ecceab1be8c26ac535101b93dead1df9de10d92bd6cceb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WebCacheV01.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
          • Size 14.0MB
          • SHA256 0a8f6404f09fb6a3fec340061eb21af1cc537e8f1d375c1388fde4cd42b30288
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WebCacheV01.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
          • Size 14.0MB
          • SHA256 8d33184cc2c9ace1cb78ce60e8351e8aed2ba138aeead0c5e0e247877ec8e28a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WebCacheV01.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
          • Size 14.0MB
          • SHA256 cc7ad20f55f896200af6435a5db8df3a58882027140da5bc0d12e584c1d6a6fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleaner.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner.exe
          • Size 37.8MB
          • SHA256 abad821c16ff054abbca8d1ba0446ddb0d039d80bfc69e4cb9df3445f6235d2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleaner64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleaner64.exe
          • Size 43.8MB
          • SHA256 6f272f31130ea208059306e1dd0acd286864e9895e2eaa792603104eaf1b6022
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleanerDU.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerDU.dll
          • Size 13.3MB
          • SHA256 2ded87de4195ab9616ca8fc061b13a6e34f4ebd8bad4b157f4dcd7af600a6a67
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleanerPerformanceOptimizer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerPerformanceOptimizer.dll
          • Size 13.0MB
          • SHA256 2286047921091ba3e5016b8022ef2ebb49df53c49ad258dd12e119dde9ba0f76
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleanerPerformanceOptimizerService.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerPerformanceOptimizerService.exe
          • Size 1.0MB
          • SHA256 fb8c4906dfaf7c4ef17d2ccdaba7b091cbeec8762ae2335811946070d29d3ebb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleanerReactivator.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerReactivator.dll
          • Size 2.2MB
          • SHA256 ea81dd896d97992db5b492478c0e96e1ec9c9acc329ce238eeb33ed700fc7234
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CCleanerReactivator.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CCleanerReactivator.exe
          • Size 188KB
          • SHA256 f08c2b9c5c4ae7db76df50723f81d6841dddf257d4dd04beac89d499622773fa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DUState.dat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DUState.dat
          • Size 13KB
          • SHA256 96a038b923e9a75a62202457aa00db2212850edb2d7845d3890528176705225a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DUState.dat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DUState.dat
          • Size 158KB
          • SHA256 f2b611b1931914b2193860908aad7a21137f03d7986b29db4a93cafa845cb71f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          44ED97C8-2D40-4A50-913D-673F6858B9AF
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
          • Size 14B
          • SHA256 79d9b3f87708bedda20ade283d8f4bb9d8f6348069d219c02ea1c354e9ec7e20
          • MD5 SHA1 SHA512
          Submit Download

          state_cache.json
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\state_cache.json
          • Size 677B
          • SHA256 063ebf79a46810f92a7347d1636a0f96792d76a1397cad4c97cc7aef7c39d41b
          • MD5 SHA1 SHA512
          Submit Download

          usercfg.ini
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\usercfg.ini
          • Size 122B
          • SHA256 003842902150626761965f77479fa3c29caab79314d48763a54e7876e42ba3fb
          • MD5 SHA1 SHA512
          Submit Download

          usercfg.ini
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\usercfg.ini
          • Size 131B
          • SHA256 4b07b1bf91e4bbccf9e9b72120cb41df54d737ac9180fb82f1e1a0641e4ff15f
          • MD5 SHA1 SHA512
          Submit Download

          DriverUpdEng.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\DriverUpdEng.log
          • Size 1KB
          • SHA256 82786d5a336c1d29fedc00b93bb86023c0b63692cfefc8c93f4655ea10fabb59
          • MD5 SHA1 SHA512
          Submit Download

          DriverUpdEngTask.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\DriverUpdEngTask.log
          • Size 3B
          • SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
          • MD5 SHA1 SHA512
          Submit Download

          DriverUpdaterLib.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\DriverUpdaterLib.log
          • Size 9KB
          • SHA256 13ec83f78c7d18b3388ba7763cc4c248aeff6b96875c5174f5a24fd4e9e32f66
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          44ED97C8-2D40-4A50-913D-673F6858B9AF
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
          • Size 14B
          • SHA256 1f7630cb9568e85a2301fd4b708bb9be813c18154cad9e6507da780b42b544db
          • MD5 SHA1 SHA512
          Submit Download

          event_manager.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\event_manager.log
          • Size 107B
          • SHA256 e2b52276c71c922b19640b6314439067a3a2921359d1c3ab3552030b351aeb59
          • MD5 SHA1 SHA512
          Submit Download

          event_manager.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\event_manager.log
          • Size 210B
          • SHA256 9940a222b7a993c616a13212daf6595b62922a6bbd0ca55f65e14a98c3ed0642
          • MD5 SHA1 SHA512
          Submit Download

          pd.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\pd.log
          • Size 4KB
          • SHA256 b4e89ff40f420b74ac5eea7dca9f4280b6839e3135c283e8d09f79e8b549b4e2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          su_adapter.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\su_adapter.log
          • Size 11KB
          • SHA256 9d1ba7232ea41479403802912c757d0cdf78dfe0ece63468b94aeff92fc5fc3b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          su_controller.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\su_controller.log
          • Size 1KB
          • SHA256 2e7d710a1b4fe11b2ef487635bac7c7f25d4954f9fb0eaf418ea23b0fa7983a0
          • MD5 SHA1 SHA512
          Submit Download

          su_telemetry.log
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOG\su_telemetry.log
          • Size 106B
          • SHA256 c26325b5aaf61adb757ea62048e090b28444a71c101124f4a5f7e59d114cc4fb
          • MD5 SHA1 SHA512
          Submit Download

          config.def
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\config.def
          • Size 27B
          • SHA256 09c65b39bc891e12956ab7bb30fae147ef7c8fa37542b6f040613436b566e7f8
          • MD5 SHA1 SHA512
          Submit Download

          ccl.bat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ccl.bat
          • Size 23B
          • SHA256 1c5a7828326ca42cfde80b92665a7ce969a54c2c29b09ae0b202efcef1a914c1
          • MD5 SHA1 SHA512
          Submit Download

          gcapi_17462808714592.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gcapi_17462808714592.dll
          • Size 740KB
          • SHA256 8b6ce3a640e2d6f36b0001be2a1abb765ae51e62c314a15911e75138cbb544bb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lc.dat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\lc.dat
          • Size 4KB
          • SHA256 80d246639b868d170db6dcb4ae9f6541c40ce1d5f013bea5f774ccd042193c2a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwaapi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwaapi.dll
          • Size 1.0MB
          • SHA256 47de51d5d1463126c36bd7aa4919daac036b9024e1451b405ba73387f5bde7b3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwaheap.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwaheap.dll
          • Size 100KB
          • SHA256 820b88dc8a7b144564232a336704e396bf237bdbe9e904602194d888591fc589
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwalocal.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwalocal.dll
          • Size 1.8MB
          • SHA256 f36a7fccb6d794ca83f921a1b6cb863958ef29ab5cfab9691b83c068ad8a4c18
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwaresource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwaresource.dll
          • Size 5.3MB
          • SHA256 5cb4e76e03fcc2047bc3d8821023fc09246762923a6aae2ddf8621f7b7e7700e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwautils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwautils.dll
          • Size 3.5MB
          • SHA256 234c2984a56df5dc2cab301869ea8c5e9f67c30d2b0e48e75d40477d26cb5a78
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwavmodapi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libwavmodapi.dll
          • Size 5.0MB
          • SHA256 f0bc562659688923ca3675b251875e1b0ea73bbc04d77013db4237015c1bdc90
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wa_3rd_party_host_64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\wa_3rd_party_host_64.exe
          • Size 364KB
          • SHA256 ed21b436aba685f1c0486c97c2c1994d058180973de2f48beb7990b918da2e91
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          handler.bat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\handler.bat
          • Size 403B
          • SHA256 687f5ad312a5710e75070ec823174afa00e1f15be0daa389fc5fed87e2bebe02
          • MD5 SHA1 SHA512
          Submit Download

          Google Handler.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Handler.lnk
          • Size 1KB
          • SHA256 bfa9c093bb1722e5666ce26f742809bc5ea779331f008f2ef1a9d9e7783ee44b
          • MD5 SHA1 SHA512
          Submit Download

          Google Handler.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Handler.lnk
          • Size 1KB
          • SHA256 f71dd18ba09118d106783a2fbf5bfeb9df83cf6d56fe7b9d77cfecac846e836c
          • MD5 SHA1 SHA512
          Submit Download

          CCleanerCrashReporting.job
          • Path C:\Windows\Tasks\CCleanerCrashReporting.job
          • Size 700B
          • SHA256 fd04cf83d9d66ea8d09fdb2981bb8a57de184827850d7aeb14ada0fdb04e6a93
          • MD5 SHA1 SHA512
          Submit Download

          CCleanerCrashReporting.job
          • Path C:\Windows\Tasks\CCleanerCrashReporting.job
          • Size 700B
          • SHA256 8183a1be10e17586bdd59029a1598e4087df1be055028fac1869da0590916196
          • MD5 SHA1 SHA512
          Submit Download

          ccleanerbugreport.exe
          • Path \??\c:\users\admin\appdata\local\temp\rarsfx0\ccleanerbugreport.exe
          • Size 5.9MB
          • SHA256 3b9c441f9cca9558641e7e055dc8c2e40aeaff62099d9dc36e616e2d03c4ce6f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/4592-241-0x00000172585B0000-0x00000172585C0000-memory.dmp
          Download

          memory/4592-204-0x00007FFF1EC70000-0x00007FFF1EC71000-memory.dmp
          Download

          memory/4592-276-0x0000017268B00000-0x0000017268B01000-memory.dmp
          Download

          memory/4592-275-0x0000017268B10000-0x0000017268B18000-memory.dmp
          Download

          memory/4592-273-0x0000017268C60000-0x0000017268C68000-memory.dmp
          Download

          memory/4592-249-0x0000017258630000-0x0000017258640000-memory.dmp
          Download

          memory/4592-281-0x0000017268B00000-0x0000017268B08000-memory.dmp
          Download

          memory/4592-206-0x00007FFF1E8E0000-0x00007FFF1E8E1000-memory.dmp
          Download

          memory/4592-205-0x00007FFF1EC20000-0x00007FFF1EC21000-memory.dmp
          Download

          memory/4592-278-0x0000017268B10000-0x0000017268B18000-memory.dmp
          Download

          memory/4592-284-0x0000017268AC0000-0x0000017268AC1000-memory.dmp
          Download

          memory/4592-203-0x00007FFF1EC10000-0x00007FFF1EC11000-memory.dmp
          Download

          memory/4592-292-0x0000017268B40000-0x0000017268B48000-memory.dmp
          Download

          memory/4592-202-0x00007FFF1EC00000-0x00007FFF1EC01000-memory.dmp
          Download

          memory/4592-294-0x0000017268C30000-0x0000017268C38000-memory.dmp
          Download

          memory/4592-297-0x0000017268B00000-0x0000017268B01000-memory.dmp
          Download

          memory/4592-301-0x0000017268AC0000-0x0000017268AC1000-memory.dmp
          Download

          memory/4592-201-0x00007FFF1EBF0000-0x00007FFF1EBF1000-memory.dmp
          Download

          memory/4592-200-0x00007FFF1EBE0000-0x00007FFF1EBE1000-memory.dmp
          Download

          memory/4592-199-0x00007FFF1EBD0000-0x00007FFF1EBD1000-memory.dmp
          Download