Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 17

• Anti-Detection/Stealthyness
  • Creates a resource fork (ADS) file (often used to hide data)

    details

    "CCleaner.exe" created file "C:"

    source

    API Call

    relevance

    8/10

  • Queries firmware table information (may be used to fingerprint/evade)

    details

    "ccsetup579pro.exe" at 00064500-00003664-00000105-13018167942524865
    "ccsetup579pro.exe" at 00064500-00003664-00000105-13018167942524982
    "CCUpdate.exe" at 00068284-00000332-00000105-3362292
    "CCUpdate.exe" at 00068284-00000332-00000105-3362400
    "CCUpdate.exe" at 00068573-00002172-00000105-4402181
    "CCUpdate.exe" at 00068573-00002172-00000105-4402415
    "CCUpdate.exe" at 00068573-00002172-00000105-13018167883800261
    "CCUpdate.exe" at 00068573-00002172-00000105-13018167883800387
    "CCleaner.exe" at 00069263-00002040-00000105-13280930
    "CCleaner.exe" at 00069263-00002040-00000105-13281055
    "CCleaner.exe" at 00069263-00002040-00000105-13879576
    "CCleaner.exe" at 00069263-00002040-00000105-13879758
    "CCleaner.exe" at 00069263-00002040-00000105-13018167902992520
    "CCleaner.exe" at 00069263-00002040-00000105-13018167902993060
    "CCleaner.exe" at 00073926-00002564-00000105-14505558
    "CCleaner.exe" at 00073926-00002564-00000105-14505846
    "CCleaner.exe" at 00073926-00002564-00000105-15207296
    "CCleaner.exe" at 00073926-00002564-00000105-15207494
    "CCleaner.exe" at 00073926-00002564-00000105-13018167809053684
    "CCleaner.exe" at 00073926-00002564-00000105-13018167809053912
    "CCUpdate.exe" at 00080346-00002644-00000105-1385205
    "CCUpdate.exe" at 00080346-00002644-00000105-1385446
    "CCleaner.exe" at 00080603-00001340-00000105-13801363
    "CCleaner.exe" at 00080603-00001340-00000105-13801557
    "CCleaner.exe" at 00080603-00001340-00000105-14622674
    "CCleaner.exe" at 00080603-00001340-00000105-14622870
    "CCleaner.exe" at 00082416-00003740-00000105-8334460
    "CCleaner.exe" at 00082416-00003740-00000105-8334696
    "CCleaner.exe" at 00082416-00003740-00000105-313573161
    "CCleaner.exe" at 00082416-00003740-00000105-313573355
    "CCleaner.exe" at 00082416-00003740-00000105-314547924
    "CCleaner.exe" at 00082416-00003740-00000105-314548179

    source

    API Call

    relevance

    10/10

    ATT&CK ID

    T1120 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads Antivirus engine related registry keys

    details

    "CCleaner.exe" (Path: "HKCU\SOFTWARE\AVG\BROWSER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\BROWSER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\SYMANTEC\NORTON ANTIVIRUS NT\INSTALL\7.50")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\SYMANTEC\SYMANTEC ANTIVIRUS\INSTALL\7.50")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\COMPUTERASSOCIATES\ANTI-VIRUS")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\CLAMWIN")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MALWAREBYTES' ANTI-MALWARE")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\SUPERANTISPYWARE.COM\SUPERANTISPYWARE")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\AVG8")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\AVG9")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\AVG10")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\AVG2012")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG\AVG2013")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVIRA\ANTIVIR DESKTOP")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\AVIRA\ANTIVIRUS")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 10")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 11")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 14")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\360BROWSER\BROWSER")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\360SAFE")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 5")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 6")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 7")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 2007")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 8")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 2009")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 12")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 15")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 16")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 2016")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 18")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO BURNING STUDIO 2017")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO SNAP 7")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO SNAP 8")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO SNAP 9")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\ASHAMPOO\ASHAMPOO SNAP 10")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\AVG")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\AVG\AWL\REGISTRYCLEANER")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1063 (Show technique in the MITRE ATT&CK™ matrix)

• Environment Awareness
  • Reads the registry for VMWare specific artifacts

    details

    "CCleaner.exe" (Path: "HKLM\SOFTWARE\VMWARE, INC.\VMWARE PLAYER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\VMWARE, INC.\INSTALLER\VMWARE WORKSTATION")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• General
  • The analysis extracted a file that was identified as malicious

    details

    1/87 Antivirus vendors marked dropped file "ButtonEvent.dll" as malicious (classified as "Malware.Generic" with 1% detection rate)
    1/85 Antivirus vendors marked dropped file "inetc.dll" as malicious (classified as "Malware.Generic" with 1% detection rate)
    1/67 Antivirus vendors marked dropped file "System.dll" as malicious (classified as "Malware.Generic" with 1% detection rate)

    source

    Binary File

    relevance

    10/10

• Installation/Persistence
  • Loads the task scheduler COM API

    details

    "ccsetup579pro.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73A40000
    "CCleaner.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73A40000
    "CCUpdate.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73A40000

    source

    Loaded Module

    relevance

    5/10

    ATT&CK ID

    T1168 (Show technique in the MITRE ATT&CK™ matrix)

  • Writes data to a remote process

    details

    "CCUpdate.exe" wrote 1500 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCUpdate.exe" (Handle: 924)
    "CCUpdate.exe" wrote 4 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCUpdate.exe" (Handle: 924)
    "CCUpdate.exe" wrote 32 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCUpdate.exe" (Handle: 924)
    "CCUpdate.exe" wrote 52 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCUpdate.exe" (Handle: 924)
    "CCUpdate.exe" wrote 4 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCleaner.exe" (Handle: 876)
    "CCUpdate.exe" wrote 32 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCleaner.exe" (Handle: 876)
    "CCUpdate.exe" wrote 52 bytes to a remote process "%PROGRAMFILES%\CCleaner\CCleaner.exe" (Handle: 876)

    source

    API Call

    relevance

    6/10

    ATT&CK ID

    T1055 (Show technique in the MITRE ATT&CK™ matrix)

• Network Related
  • Malicious artifacts seen in the context of a contacted host

    details

    Found malicious artifacts related to "151.101.2.109": ...
    
    URL: http://151.101.2.109/ (AV positives: 1/87 scanned on 05/14/2021 01:04:12)
    URL: https://m.emuparadise.me/emulators/files/ (AV positives: 1/85 scanned on 03/22/2021 03:22:15)
    URL: https://www.emuparadise.me/emulators/files/user/EmuCR-Pcsxr-r72232-535.7z (AV positives: 1/85 scanned on 03/21/2021 12:00:13)
    URL: https://m.emuparadise.me/emulators/files/user/ps2%20fceultra_0.9.3-358.zip (AV positives: 1/83 scanned on 02/11/2021 18:47:11)
    URL: http://m.emuparadise.me/roms/systems-amp.php?sysid=32 (AV positives: 1/80 scanned on 11/09/2020 16:19:06)
    File SHA256: 70ec76badad579ae140168c23e8aa70a57eaf7caaa4993ee7b5bb18cd423a9df (Date: 05/10/2021 14:43:46)
    File SHA256: 1d9f1683f0e8ed247ea3950cb07ba1cdafd76fdad20080b08c2dc280310efafe (Date: 05/04/2021 05:39:05)
    File SHA256: 8e01972712663e1d5484492515068af7ec973c906d3948b379dead63ae0884a2 (Date: 04/28/2021 21:00:34)
    File SHA256: 8dc657f3e5e9ca41602247e3cae6346a08382248ba729e3749ed905b26769c56 (Date: 04/16/2021 16:51:19)
    File SHA256: a0834979432dac305e0ff255c42ab4b5ba532b0d3379c2ffbe39383842642306 (Date: 04/14/2021 14:50:01)
    File SHA256: 45c9a32bf9e3afc8772f62d633c59bb8442d93c8a6cd68cf504674da26cbc369 (AV positives: 1/74 scanned on 04/02/2021 02:04:54)
    File SHA256: 3f831ca28b797320825e4dff96f2e7c937daadcb175918306bf466e03afcf0a5 (AV positives: 1/75 scanned on 08/10/2020 12:21:58)
    File SHA256: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 (AV positives: 1/74 scanned on 06/04/2020 21:52:58)
    File SHA256: 46e1a7ad3dc9c75763440c153465cdccc9a3ba367e3158542953ece4bcdb7b4f (AV positives: 3/74 scanned on 05/22/2020 14:34:15)
    File SHA256: 173fe71b45998cba39f596daf4afcad7a0dcfa7ff0a1f3f7a77bca9e44b78a0e (AV positives: 1/74 scanned on 04/10/2020 19:43:31)
    Found malicious artifacts related to "104.16.242.229": ...
    
    URL: https://secure.advancedsystemrepair.com/1663/scp/S34570757-GokYdHosp9Zpsijs (AV positives: 1/85 scanned on 04/04/2021 23:14:42)
    URL: http://secure.advancedsystemrepair.com/1663/p/265256413-fup3lsautsyjde0cda97 (AV positives: 1/85 scanned on 03/23/2021 15:54:02)
    URL: https://secure.advancedsystemrepair.com/1663/p/265256413-fuP3lsAUTsyJde0CDa97 (AV positives: 1/85 scanned on 03/22/2021 22:35:12)
    URL: https://secure.advancedsystemrepair.com/1663/p/217360973-MbKsdqezVg8VfCE8qOo7 (AV positives: 1/85 scanned on 03/12/2021 16:24:57)
    URL: https://secure.advancedsystemrepair.com/mail/289579576-9F34LQLV (AV positives: 1/84 scanned on 03/09/2021 14:55:04)
    File SHA256: 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c (AV positives: 11/74 scanned on 05/12/2021 21:15:52)
    File SHA256: 3e4e2aa7273428e07a4a322d8c00833554e465035ea963e43df8e6e52a9c576a (AV positives: 8/74 scanned on 04/25/2021 08:39:25)
    File SHA256: ce820f52d9c8206cd5ca69c6040cf05ef94d9fda4cf01eb272e5459906bcf97b (AV positives: 1/74 scanned on 04/23/2021 05:32:35)
    File SHA256: 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a (AV positives: 6/75 scanned on 03/26/2021 01:44:47)
    File SHA256: 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc (AV positives: 6/75 scanned on 03/24/2021 00:19:50)
    Found malicious artifacts related to "104.16.243.229": ...
    
    URL: http://secure.advancedsystemrepair.com/1663/scp/s34570757-gokydhosp9zpsijs (AV positives: 1/85 scanned on 04/05/2021 15:17:59)
    URL: https://secure.advancedsystemrepair.com/1663/paypal/252176428-Ywls0zjhhdLNTC0S224C (AV positives: 1/85 scanned on 04/04/2021 23:14:42)
    URL: http://secure.advancedsystemrepair.com/1663/p/217360973-mbksdqezvg8vfce8qoo7 (AV positives: 1/85 scanned on 03/13/2021 16:26:51)
    URL: https://secure.advancedsystemrepair.com/mail/289374184-v6Qpb26W (AV positives: 1/85 scanned on 03/13/2021 09:29:53)
    URL: https://secure.advancedsystemrepair.com/mail/291916320-L4nsjgXi (AV positives: 1/85 scanned on 03/13/2021 07:29:44)
    File SHA256: 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c (AV positives: 10/74 scanned on 05/03/2021 19:14:18)
    File SHA256: 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a (AV positives: 6/75 scanned on 03/26/2021 01:44:47)
    File SHA256: 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc (AV positives: 6/75 scanned on 03/24/2021 00:19:50)
    File SHA256: b4f16571e1af4473812ddee32939f3e9aa745a4513b2f5bbfe68f22165c77591 (AV positives: 1/75 scanned on 02/24/2021 12:23:25)
    File SHA256: ad96e2d1058ffc92548c560be63d139291c128d06f30d44791e396131fe35896 (AV positives: 3/75 scanned on 02/11/2021 11:22:42)
    File SHA256: 7cc17be7358cf0be8743f08b4569305c456635eba3414e06fd116f356da425d4 (Date: 12/03/2020 23:21:49)
    File SHA256: 590dd73359d0345e8462120cfd0314c7526b81a2232effa5fa9abe91e7e5dc3e (Date: 11/30/2020 15:47:26)
    File SHA256: 3fdbad5ebe4756ef14fd21cabb4792904bb25baa7cb64f8a5c9b0bcecc6ae199 (Date: 11/24/2020 19:32:28)
    File SHA256: 511c94d56c0bde9e0847894640cb3d71802f56f02e954515e5d1780eba03b277 (Date: 08/29/2020 09:18:49)
    File SHA256: 93418983608109ee85d8b74b9d57018953015cb254576671dfba2108784f191c (Date: 12/05/2019 06:53:54)

    source

    Network Traffic

    relevance

    10/10

• Spyware/Information Retrieval
  • Scans for artifacts that may help identify the target

    details

    "CCleaner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\MSNMESSENGER\PERPASSPORTSETTINGS")
    "CCleaner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS LIVE MAIL")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Touched instant messenger related registry keys

    details

    "CCleaner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS LIVE MAIL")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

• System Destruction
  • Interacts with the primary disk partition (DR0)

    details

    "ccsetup579pro.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x2d1400
    "ccsetup579pro.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x74080
    "ccsetup579pro.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x7c088
    "CCUpdate.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x74080
    "CCUpdate.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x7c088
    "CCUpdate.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x2d1400
    "CCleaner.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x2d1400
    "CCleaner.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x74080
    "CCleaner.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x7c088

    source

    API Call

    relevance

    5/10

    ATT&CK ID

    T1067 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Checks for a resource fork (ADS) file

    details

    "ccsetup579pro.exe" checked file "C:"
    "CCleaner.exe" checked file "C:"

    source

    API Call

    relevance

    5/10

  • Spawns a lot of processes

    details

    Spawned process "ccsetup579pro.exe" (Show Process)
    Spawned process "CCleaner.exe" with commandline "/createSkipUAC" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/reg" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/emupdater /applydll "%PROGRAMFILES%\CCleaner\Setup\e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll"" (Show Process)
    Spawned process "CCleaner.exe" (Show Process)
    Spawned process "CCleaner.exe" with commandline "/monitor" (Show Process)
    Spawned process "CCUpdate.exe" (Show Process)
    Spawned process "CCleaner.exe" with commandline "dummy /ccupdate" (Show Process)
    Spawned process "CCleaner.exe" with commandline "/MONITOR" (Show Process)

    source

    Monitored Target

    relevance

    8/10

• Hiding 4 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 36

• Environment Awareness
  • Reads the cryptographic machine GUID

    details

    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
    "CCUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the windows installation date

    details

    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "INSTALLDATE")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ETPRO POLICY CCleaner Update Agent User-Agent Observed" (SID: 2839344, Rev: 1, Severity: 2) categorized as "Potentially Bad Traffic"

    source

    Suricata Alerts

    relevance

    10/10

  • Found an IP/URL artifact that was identified as malicious by at least one reputation engine

    details

    1/72 reputation engines marked "http://www.digicert.com/cps0" as malicious (1% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Reads configuration files

    details

    "ccsetup579pro.exe" read file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini"
    "CCleaner.exe" read file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini"
    "CCleaner.exe" read file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini"
    "CCleaner.exe" read file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini"
    "CCleaner.exe" read file "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini"
    "CCleaner.exe" read file "%APPDATA%\Mozilla\Firefox\profiles.ini"

    source

    API Call

    relevance

    4/10

• Installation/Persistence
  • Allocates virtual memory in a remote process

    details

    "CCUpdate.exe" allocated memory in "%PROGRAMFILES%\CCleaner\Setup\b257d5c9-93f5-4e6e-b4d5-de640e9938c4.xml"

    source

    API Call

    relevance

    7/10

    ATT&CK ID

    T1055 (Show technique in the MITRE ATT&CK™ matrix)

  • Drops executable files

    details

    "CCUpdate.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "CCleaner.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "ButtonEvent.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1040.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-2074.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1035.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "pfUI.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1036.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1056.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1063.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1109.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
    "lang-1065.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-5146.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-3098.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1057.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1042.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"

    source

    Binary File

    relevance

    10/10

  • Modifies auto-execute functionality by setting/creating a value in the registry

    details

    "CCleaner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "CCLEANER SMART CLEANING"; Value: ""%PROGRAMFILES%\CCleaner\CCleaner.exe" /MONITOR")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1060 (Show technique in the MITRE ATT&CK™ matrix)

• Network Related
  • Sends traffic on typical HTTP outbound port, but without HTTP header

    details

    TCP traffic to 69.94.68.202 on port 443 is sent without HTTP header
    TCP traffic to 151.101.0.64 on port 443 is sent without HTTP header
    TCP traffic to 54.204.119.115 on port 443 is sent without HTTP header
    TCP traffic to 5.62.44.49 on port 443 is sent without HTTP header
    TCP traffic to 69.94.68.200 on port 443 is sent without HTTP header
    TCP traffic to 5.62.38.20 on port 443 is sent without HTTP header
    TCP traffic to 23.55.62.209 on port 80 is sent without HTTP header
    TCP traffic to 23.55.62.147 on port 80 is sent without HTTP header
    TCP traffic to 5.62.48.213 on port 443 is sent without HTTP header
    TCP traffic to 151.101.2.202 on port 443 is sent without HTTP header
    TCP traffic to 151.101.2.109 on port 443 is sent without HTTP header
    TCP traffic to 18.233.120.6 on port 443 is sent without HTTP header
    TCP traffic to 151.101.2.202 on port 80 is sent without HTTP header
    TCP traffic to 104.16.242.229 on port 443 is sent without HTTP header
    TCP traffic to 104.16.243.229 on port 443 is sent without HTTP header
    TCP traffic to 34.96.102.137 on port 443 is sent without HTTP header
    TCP traffic to 54.201.108.228 on port 443 is sent without HTTP header
    TCP traffic to 216.58.194.163 on port 80 is sent without HTTP header
    TCP traffic to 192.124.249.24 on port 80 is sent without HTTP header
    TCP traffic to 142.250.141.157 on port 443 is sent without HTTP header

    source

    Network Traffic

    relevance

    5/10

    ATT&CK ID

    T1043 (Show technique in the MITRE ATT&CK™ matrix)

  • Uses a User Agent typical for browsers, although no browser was ever launched

    details

    Found user agent(s): Mozilla/4.0 (CCleaner, 5.79.8704)

    source

    Network Traffic

    relevance

    10/10

• System Destruction
  • Marks file for deletion

    details

    "C:\ccsetup579pro.exe" marked "%TEMP%\nso68A4.tmp" for deletion
    "C:\ccsetup579pro.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\nsj69BF.tmp" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\gcapi_16210429362960.dll" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Program Files\CCleaner\Setup\c3009396-1f5d-4546-8aba-0e6a2ecef928.ini" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Program Files\CCleaner\Setup\eadce05c-c802-47ba-b12b-9e1d98a84239.xml" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Program Files\CCleaner\Setup\e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\asw83d7927c2ef38937.tmp" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\asw9c3583cf18454b5e.tmp" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\asw4fab7293a5a9266d.tmp" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\gcapi_16210430302040.dll" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\autotrial.dat" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ed7a5cc3cca8d52a.customDestinations-ms~RF11998d.TMP" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\gcapi_16210434242564.dll" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Program Files\CCleaner\Setup\65d699ce-db80-4e95-9dfa-96eb9b05e936.ini" for deletion
    "%PROGRAMFILES%\CCleaner\CCUpdate.exe" marked "C:\Program Files\CCleaner\Setup\b257d5c9-93f5-4e6e-b4d5-de640e9938c4.xml" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\gcapi_16210440491340.dll" for deletion
    "%PROGRAMFILES%\CCleaner\CCleaner.exe" marked "C:\Program Files\CCleaner\gcapi_16210441173740.dll" for deletion

    source

    API Call

    relevance

    10/10

    ATT&CK ID

    T1107 (Show technique in the MITRE ATT&CK™ matrix)

  • Opens file with deletion access rights

    details

    "ccsetup579pro.exe" opened "%TEMP%\nso68A4.tmp" with delete access
    "ccsetup579pro.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\nsj69BF.tmp" with delete access
    "ccsetup579pro.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log" with delete access
    "ccsetup579pro.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\res1.log" with delete access
    "ccsetup579pro.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\res2.log" with delete access
    "ccsetup579pro.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\tmp.edb" with delete access
    "CCleaner.exe" opened "C:\Program Files\CCleaner\gcapi_dll.dll" with delete access
    "CCUpdate.exe" opened "C:\Program Files\CCleaner\Setup\c3009396-1f5d-4546-8aba-0e6a2ecef928.ini" with delete access
    "CCUpdate.exe" opened "C:\Program Files\CCleaner\Setup\e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" with delete access
    "CCUpdate.exe" opened "C:\Program Files\CCleaner\Setup\eadce05c-c802-47ba-b12b-9e1d98a84239.xml" with delete access

    source

    API Call

    relevance

    7/10

• System Security
  • Hooks API calls

    details

    "EnableScrollBar@USER32.DLL" in "CCleaner.exe"
    "ShowScrollBar@USER32.DLL" in "CCleaner.exe"
    "GetScrollPos@USER32.DLL" in "CCleaner.exe"
    "SetScrollRange@USER32.DLL" in "CCleaner.exe"
    "SetScrollPos@USER32.DLL" in "CCleaner.exe"
    "GetScrollInfo@USER32.DLL" in "CCleaner.exe"
    "SetScrollInfo@USER32.DLL" in "CCleaner.exe"
    "GetScrollRange@USER32.DLL" in "CCleaner.exe"

    source

    Hook Detection

    relevance

    10/10

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

  • Modifies Software Policy Settings

    details

    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")
    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Modifies proxy settings

    details

    "CCleaner.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
    "CCleaner.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
    "CCleaner.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
    "CCleaner.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "CCleaner.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Queries sensitive IE security settings

    details

    "CCleaner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • CRC value set in PE header does not match actual value

    details

    "ButtonEvent.dll" claimed CRC 0 while the actual is CRC 715810
    "lang-1040.dll" claimed CRC 188987 while the actual is CRC 49802
    "lang-2074.dll" claimed CRC 190094 while the actual is CRC 188987
    "lang-1035.dll" claimed CRC 129536 while the actual is CRC 190094
    "pfUI.dll" claimed CRC 14310178 while the actual is CRC 129536
    "lang-1036.dll" claimed CRC 185731 while the actual is CRC 5287235
    "lang-1056.dll" claimed CRC 143394 while the actual is CRC 185731
    "lang-1063.dll" claimed CRC 161675 while the actual is CRC 143394
    "lang-1109.dll" claimed CRC 136840 while the actual is CRC 161675
    "uninst.exe" claimed CRC 1403816 while the actual is CRC 136840
    "lang-1065.dll" claimed CRC 174532 while the actual is CRC 1403816
    "lang-5146.dll" claimed CRC 131783 while the actual is CRC 174532
    "e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" claimed CRC 523279 while the actual is CRC 131783
    "lang-3098.dll" claimed CRC 152273 while the actual is CRC 65385
    "lang-1057.dll" claimed CRC 172118 while the actual is CRC 152273
    "lang-1042.dll" claimed CRC 74073 while the actual is CRC 172118
    "lang-2052.dll" claimed CRC 87018 while the actual is CRC 74073
    "lang-1031.dll" claimed CRC 130027 while the actual is CRC 87018
    "lang-1026.dll" claimed CRC 169595 while the actual is CRC 130027
    "lang-1092.dll" claimed CRC 106525 while the actual is CRC 169595

    source

    Static Parser

    relevance

    10/10

  • Imports suspicious APIs

    details

    RegCreateKeyExW
    RegCloseKey
    RegDeleteKeyW
    SetSecurityDescriptorDacl
    OpenProcessToken
    RegOpenKeyExW
    CreateProcessAsUserW
    RegDeleteValueW
    StartServiceW
    GetFileAttributesW
    FindResourceExW
    DeviceIoControl
    CopyFileW
    OutputDebugStringW
    GetModuleFileNameW
    IsDebuggerPresent
    UnhandledExceptionFilter
    LoadLibraryExW
    CreateThread
    ExitThread
    TerminateProcess
    GetModuleHandleExW
    LoadLibraryW
    GetVersionExW
    GetTickCount
    GetFileSize
    OpenProcess
    GetStartupInfoW
    CreateDirectoryW
    DeleteFileW
    GetProcAddress
    WriteFile
    GetFileSizeEx
    FindNextFileW
    FindFirstFileW
    FindFirstFileExW
    CreateFileW
    CreateFileMappingW
    FindResourceW
    LockResource
    GetCommandLineW
    GetCommandLineA
    GetTickCount64
    MapViewOfFile
    GetModuleHandleW
    GetFileAttributesExW
    GetTempPathW
    CreateProcessW
    Sleep
    VirtualAlloc
    HttpQueryInfoW
    InternetWriteFile
    InternetOpenW
    InternetConnectW
    InternetCrackUrlW
    HttpSendRequestExW
    InternetCloseHandle
    HttpSendRequestW
    InternetReadFile
    FtpOpenFileW
    FindWindowExW
    RegEnumKeyW
    LoadLibraryA
    GetTempFileNameW
    ShellExecuteW
    VirtualProtect
    GetModuleHandleA
    CreateFileA
    SleepEx
    InternetQueryOptionW
    RegEnumKeyExW
    GetDriveTypeW
    OutputDebugStringA
    GetVersionExA
    LoadLibraryExA
    GetComputerNameW
    GetCursorPos
    GetWindowThreadProcessId
    InternetOpenUrlW
    WSAStartup

    source

    Static Parser

    relevance

    1/10

  • Installs hooks/patches the running process

    details

    "ccsetup579pro.exe" wrote bytes "c04ea8772054a977e065a977b538aa770000000000d0bd7600000000c5eabd760000000088eabd7600000000e968ad758228aa77ee29aa7700000000d269ad75000000007dbbbd760000000009bead7500000000ba18bd7600000000" to virtual address "0x77C01000" (part of module "NSI.DLL")
    "ccsetup579pro.exe" wrote bytes "7da3bd7695a3bd7682f3bc7600d0bd761f93bc76987bbf76bccebd761af1bd762c69bf76f8bfbd762fadbd7662f1bd76d4cebd7627f1bd765ac6bd76252ebd7687f1bd76000000003d425c7700000000d1e4df750822e27500000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL")
    "ccsetup579pro.exe" wrote bytes "d055fc75647305760000000051c13f7794983f77ee9c3f7775dc4177273e41770fb3457700000000acdcbd761bf7bd76c108bf76c0d9bd76152ebd7636dabd76d5d9bd7630c6bd76e0c2bd7642c6bd761bc6bd7686c4bd7672c6bd7600000000" to virtual address "0x70C41000" (part of module "SHFOLDER.DLL")
    "ccsetup579pro.exe" wrote bytes "b81015876effe0" to virtual address "0x757E11F8" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "b88011876effe0" to virtual address "0x76E11368" (part of module "WS2_32.DLL")
    "ccsetup579pro.exe" wrote bytes "a011876e" to virtual address "0x70F94028" (part of module "WEBIO.DLL")
    "ccsetup579pro.exe" wrote bytes "a011876e" to virtual address "0x7730E324" (part of module "WININET.DLL")
    "ccsetup579pro.exe" wrote bytes "f8117e75" to virtual address "0x757F8368" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "48127e75" to virtual address "0x757F8364" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "fae6a577e1a6aa772e71aa77ee29aa7785e2a5776da0aa7726e4a577d16daa77003da877804ba87700000000ad37e1768b2de176b641e17600000000" to virtual address "0x74DC1000" (part of module "WSHTCPIP.DLL")
    "ccsetup579pro.exe" wrote bytes "f8117e75" to virtual address "0x757F83E0" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "c2000000" to virtual address "0x10004020" (part of module "SYSTEM.DLL")
    "ccsetup579pro.exe" wrote bytes "68130000" to virtual address "0x76E11680" (part of module "WS2_32.DLL")
    "ccsetup579pro.exe" wrote bytes "48120000" to virtual address "0x757E139C" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "48120000" to virtual address "0x757E12DC" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "48127e75" to virtual address "0x757F83DC" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "d5d9bd7630c6bd76e0c2bd7642c6bd7610c6bd76acdcbd76a0dfbd7636dabd7687f1bd76000000009177bb77c090bb777f6fbb771ffabb77def4bb77f282bb77857dbb7700000000" to virtual address "0x73231000" (part of module "MSIMG32.DLL")
    "ccsetup579pro.exe" wrote bytes "e739a677e1a6aa772e71aa77ee29aa7785e2a5776da0aa779064a9773ad5b07726e4a577d16daa77003da877804ba87700000000ad37e1768b2de176b641e17600000000" to virtual address "0x75311000" (part of module "WSHIP6.DLL")
    "ccsetup579pro.exe" wrote bytes "f8110000" to virtual address "0x757E12CC" (part of module "SSPICLI.DLL")
    "ccsetup579pro.exe" wrote bytes "f8117e75" to virtual address "0x757F834C" (part of module "SSPICLI.DLL")

    source

    Hook Detection

    relevance

    10/10

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads information about supported languages

    details

    "ccsetup579pro.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
    "CCleaner.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Hiding 16 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 31

• Anti-Reverse Engineering
  • PE file contains zero-size sections

    details

    Raw size of ".data" is zero
    Raw size of ".ndata" is zero

    source

    Static Parser

    relevance

    10/10

• Environment Awareness
  • Queries volume information

    details

    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" at 00064500-00003664-0000010C-70003075
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at 00064500-00003664-0000010C-70008991
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at 00064500-00003664-0000010C-70013947
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at 00064500-00003664-0000010C-70155514
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-70158564
    "ccsetup579pro.exe" queries volume information of "%TEMP%\nsj69BF.tmp\ui\res\CC_logo_72x66.png" at 00064500-00003664-0000010C-13018167955390225
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Temp\nsj69BF.tmp\ui\res\CC_Logo_40x96.png" at 00064500-00003664-0000010C-13018167955398848
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Temp\nsj69BF.tmp\ui\res\PF_computer.png" at 00064500-00003664-0000010C-13018167955408752
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" at 00064500-00003664-0000010C-13018167962133011
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" at 00064500-00003664-0000010C-13018167962466803
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at 00064500-00003664-0000010C-13018167962555221
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962558206
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962561440
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962565333
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962573015
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at 00064500-00003664-0000010C-13018167962575167
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962581498
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962584683
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log" at 00064500-00003664-0000010C-13018167962595623
    "ccsetup579pro.exe" queries volume information of "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\tmp.edb" at 00064500-00003664-0000010C-13018167962602004

    source

    API Call

    relevance

    2/10

    ATT&CK ID

    T1120 (Show technique in the MITRE ATT&CK™ matrix)

  • Queries volume information of an entire harddrive

    details

    "CCleaner.exe" queries volume information of "C:\" at 00069263-00002040-0000010C-13018167904357511
    "CCleaner.exe" queries volume information of "C:\" at 00069263-00002040-0000010C-13018167904381356
    "CCleaner.exe" queries volume information of "C:\" at 00069263-00002040-0000010C-13018167904390589
    "CCleaner.exe" queries volume information of "C:\" at 00069263-00002040-0000010C-13018167904400200
    "CCleaner.exe" queries volume information of "C:\" at 00069263-00002040-0000010C-13018167904409773

    source

    API Call

    relevance

    8/10

    ATT&CK ID

    T1120 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the registry for installed applications

    details

    "CCUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CCLEANER.EXE")
    "CCUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CCLEANER.EXE"; Key: "PATH"; Value: "00000000010000003400000043003A005C00500072006F006700720061006D002000460069006C00650073005C00430043006C00650061006E00650072000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME"; Value: "00000000010000001800000037002D005A00690070002000310036002E00300034000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME"; Value: "000000000100000014000000410064006F006200650020004100490052000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME"; Value: "00000000010000003C000000410064006F0062006500200046006C00610073006800200050006C006100790065007200200032003700200041006300740069007600650058000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME"; Value: "000000000100000038000000410064006F00620065002000530068006F0063006B007700610076006500200050006C0061007900650072002000310032002E0033000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME"; Value: "0000000001000000220000004100750074006F00490074002000760033002E0033002E00310034002E0032000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CCLEANER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CCLEANER"; Key: "DISPLAYNAME"; Value: "000000000100000012000000430043006C00650061006E00650072000000")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME")
    "CCleaner.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• External Systems
  • Sample was identified as clean by Antivirus engines

    details

    0/32 Antivirus vendors marked sample as malicious (0% detection rate)
    0/66 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Accesses Software Policy Settings

    details

    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Accesses System Certificates Settings

    details

    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")
    "ccsetup579pro.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "ccsetup579pro.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Contacts domains

    details

    "emupdate.avcdn.net"
    "ncc.avast.com"
    "www.ccleaner.com"
    "ocsp.pki.goog"
    "ocsp.starfieldtech.com"
    "analytics.ff.avast.com"
    "ccleaner.tools.avcdn.net"
    "dev.visualwebsiteoptimizer.com"
    "ip-info.ff.avast.com"
    "ipm-provider.ff.avast.com"
    "license-api.ccleaner.com"
    "license.piriform.com"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "69.94.68.202:443"
    "151.101.0.64:443"
    "54.204.119.115:443"
    "5.62.44.49:443"
    "69.94.68.200:443"
    "5.62.38.20:443"
    "23.55.62.209:80"
    "23.55.62.147:80"
    "5.62.48.213:443"
    "151.101.2.202:443"
    "151.101.2.109:443"
    "18.233.120.6:443"
    "151.101.2.202:80"
    "104.16.242.229:443"
    "104.16.243.229:443"
    "34.96.102.137:443"
    "54.201.108.228:443"
    "216.58.194.163:80"
    "192.124.249.24:80"
    "142.250.141.157:443"

    source

    Network Traffic

    relevance

    1/10

  • Creates a writable file in a temporary directory

    details

    "ccsetup579pro.exe" created file "%TEMP%\nse699F.tmp"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\System.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\System.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\UserInfo.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\ui\res\lang-1043.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\ui\res\lang-1048.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\ui\res\lang-1063.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\ui\res\lang-2052.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\ui\res\lang-5146.dll"
    "ccsetup579pro.exe" created file "%TEMP%\nsj69BF.tmp\p\pfBL.dll"

    source

    API Call

    relevance

    1/10

  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Global\Instance0: ESENT Performance Data Schema Version 85"
    "Global\Instance0: ESENT Performance Data Schema Version 85"
    "Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511"
    "Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000"
    "Piriform_CCleaner_Monitoring"
    "Piriform_CCleaner_PreventSecondInstance"
    "\Sessions\1\BaseNamedObjects\Global\CCleanerSetupMutex"
    "Global\CCleanerSetupMutex"

    source

    Created Mutant

    relevance

    3/10

  • Drops files marked as clean

    details

    Antivirus vendors marked dropped file "CCUpdate.exe.bin" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1040.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-2074.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1035.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1036.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1056.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1063.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1109.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "uninst.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"), Antivirus vendors marked dropped file "lang-1065.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-5146.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-3098.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1057.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1042.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-2052.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1031.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1026.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "lang-1092.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")

    source

    Binary File

    relevance

    10/10

  • GETs files from a webserver

    details

    "GET /ncc.txt HTTP/1.1
    Host: ncc.avast.com
    Accept: */*"
    "GET /auto?a=3&p=cc&v=5.79.8704&l=1033&lk=CJ9T-J7CU-SPNV-GWMB-WBEC&mk=XR5C-CBG5-FT8P-HADY-2J9V-ZX2N-RD4Z-SABG-B4YJ&o=6.1W3&au=2&mx=259560ACF98DF8F51B0B9D6D74A96A4879C7D43A3198994B59D63FDEF436E58C&gd=4d633fa8-0f96-42ba-8949-00e6bf3e75ec HTTP/1.1
    User-Agent: Mozilla/4.0 (CCleaner, 5.79.8704)
    Host: www.ccleaner.com
    Cache-Control: no-cache
    Cookie: _cc_langChoice=en-US"
    "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.pki.goog"
    "GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDtqToB6jJa2wMAAAAAy%2FdX HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.pki.goog"
    "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCAoLbQoKgi1X HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    "GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCu4OaM8pepHQMAAAAAy%2FdW HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.pki.goog"
    "GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDtkv5RsdFskQMAAAAAy%2Fex HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.pki.goog"

    source

    Network Traffic

    relevance

    5/10

  • Loads rich edit control libraries

    details

    "ccsetup579pro.exe" loaded module "%WINDIR%\System32\riched20.dll" at 6E8A0000

    source

    Loaded Module

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

  • Overview of unique CLSIDs touched in registry

    details

    "ccsetup579pro.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")
    "ccsetup579pro.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}")
    "ccsetup579pro.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS")
    "ccsetup579pro.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS")
    "ccsetup579pro.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS")
    "ccsetup579pro.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")
    "ccsetup579pro.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")
    "ccsetup579pro.exe" touched "Microsoft Web Browser" (Path: "HKCU\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS")
    "ccsetup579pro.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS")
    "ccsetup579pro.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS")
    "CCleaner.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS")
    "CCleaner.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS")
    "CCleaner.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS")
    "CCleaner.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS")
    "CCleaner.exe" touched "MSAA AccPropServices" (Path: "HKCU\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\TREATAS")
    "CCleaner.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")
    "CCleaner.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")
    "CCleaner.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS")
    "CCleaner.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS")
    "CCleaner.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS")

    source

    Registry Access

    relevance

    3/10

  • Process launched with changed environment

    details

    Process "CCleaner.exe" (Show Process) was launched with modified environment variables: "Path"
    Process "CCleaner.exe" (Show Process) was launched with modified environment variables: "Path"
    Process "CCUpdate.exe" (Show Process) was launched with modified environment variables: "Path"
    Process "CCleaner.exe" (Show Process) was launched with new environment variables: "PATH="%PROGRAMFILES%\CCleaner", PROMPT="$P$G""
    Process "CCleaner.exe" (Show Process) was launched with modified environment variables: "Path"

    source

    Monitored Target

    relevance

    10/10

  • Reads Windows Trust Settings

    details

    "CCleaner.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Scanning for window names

    details

    "CCleaner.exe" searching for class "MS_AutodialMonitor"
    "CCleaner.exe" searching for class "MS_WebCheckMonitor"
    "CCleaner.exe" searching for class "Shell_TrayWnd"

    source

    API Call

    relevance

    10/10

    ATT&CK ID

    T1010 (Show technique in the MITRE ATT&CK™ matrix)

  • Spawns new processes

    details

    Spawned process "CCleaner.exe" with commandline "/createSkipUAC" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/reg" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/emupdater /applydll "%PROGRAMFILES%\CCleaner\Setup\e93cd9a7-724 ..." (Show Process), Spawned process "CCleaner.exe" (Show Process), Spawned process "CCleaner.exe" with commandline "/monitor" (Show Process), Spawned process "CCleaner.exe" with commandline "dummy /ccupdate" (Show Process)

    source

    Monitored Target

    relevance

    3/10

  • Spawns new processes that are not known child processes

    details

    Spawned process "CCleaner.exe" with commandline "/createSkipUAC" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/reg" (Show Process)
    Spawned process "CCUpdate.exe" with commandline "/emupdater /applydll "%PROGRAMFILES%\CCleaner\Setup\e93cd9a7-724 ..." (Show Process), Spawned process "CCleaner.exe" (Show Process), Spawned process "CCleaner.exe" with commandline "/monitor" (Show Process), Spawned process "CCleaner.exe" with commandline "dummy /ccupdate" (Show Process)

    source

    Monitored Target

    relevance

    3/10

  • The input sample is signed with a certificate

    details

    The input sample is signed with a certificate issued by "C=GB, L=London, O=Piriform Software Ltd, OU=RE 901, CN=Piriform Software Ltd" (SHA1: 0C:B6:BD:E0:41:B5:8D:BD:4E:C6:4B:D5:A3:BE:38:C5:0F:17:BB:3D: (1.2.840.113549.1.1.11); see report for more information)
    The input sample is signed with a certificate issued by "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA" (SHA1: 92:C1:58:8E:85:AF:22:01:CE:79:15:E8:53:8B:49:2F:60:5B:80:C6: (1.2.840.113549.1.1.11); see report for more information)
    The input sample is signed with a certificate issued by "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA" (SHA1: 05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43: (sha1RSA(RSA)); see report for more information)

    source

    Certificate Data

    relevance

    10/10

    ATT&CK ID

    T1116 (Show technique in the MITRE ATT&CK™ matrix)

  • The input sample is signed with a valid certificate

    details

    The entire certificate chain of the input sample was validated successfully.

    source

    Certificate Data

    relevance

    10/10

    ATT&CK ID

    T1116 (Show technique in the MITRE ATT&CK™ matrix)

• Installation/Persistence
  • Connects to LPC ports

    details

    "ccsetup579pro.exe" connecting to "\ThemeApiPort"
    "CCleaner.exe" connecting to "\ThemeApiPort"

    source

    API Call

    relevance

    1/10

  • Dropped files

    details

    "CCUpdate.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "CCleaner.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "ButtonEvent.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1040.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-2074.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1035.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "pfUI.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1036.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1056.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1063.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1109.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
    "lang-1065.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-5146.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-3098.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1057.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "lang-1042.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"

    source

    Binary File

    relevance

    3/10

  • Touches files in the Windows directory

    details

    "ccsetup579pro.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\WebCache\WebCacheV01.dat"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.chk"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\WebCache\V01.log"
    "ccsetup579pro.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
    "ccsetup579pro.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db"
    "ccsetup579pro.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui"
    "ccsetup579pro.exe" touched file "C:\Windows\Fonts\StaticCache.dat"
    "ccsetup579pro.exe" touched file "C:\Windows\System32"
    "ccsetup579pro.exe" touched file "C:\Windows\System32\rsaenh.dll"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Heuristic match: "r9W@$3.kp"
    Heuristic match: "ID|Ohp3^.Pn"
    Heuristic match: "N5!OT8r'.tw"
    Pattern match: "www.digicert.com110/"
    Pattern match: "http://www.digicert.com/CPS0"
    Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02"
    Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0"
    Pattern match: "http://ocsp.digicert.com0O"
    Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0"
    Pattern match: "www.digicert.com1$0"
    Pattern match: "http://ocsp.digicert.com0C"
    Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
    Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"
    Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O"
    Pattern match: "https://www.digicert.com/CPS0"
    Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P"
    Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05"
    Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0L"
    Pattern match: "http://ocsp.digicert.com0N"
    Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0"
    Pattern match: "http://www.avast.com0"
    Pattern match: "http://www.avast.com0/"
    Pattern match: "http://nsis.sf.net/NSIS_Error"
    Heuristic match: "emupdate.avcdn.net"
    Heuristic match: "HEAD /files/emupdate/pong.txt HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    User-Agent: CCleaner Update Agent
    Host: emupdate.avcdn.net"
    Heuristic match: "ncc.avast.com"
    Pattern match: "www.ccleaner.com"
    Heuristic match: "ocsp.starfieldtech.com"
    Heuristic match: "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    Heuristic match: "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    Heuristic match: "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCAoLbQoKgi1X HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.starfieldtech.com"
    Heuristic match: "analytics.ff.avast.com"
    Heuristic match: "ccleaner.tools.avcdn.net"
    Heuristic match: "dev.visualwebsiteoptimizer.com"
    Heuristic match: "ip-info.ff.avast.com"
    Heuristic match: "ipm-provider.ff.avast.com"
    Heuristic match: "license-api.ccleaner.com"
    Heuristic match: "license.piriform.com"
    Heuristic match: "seal.digicert.com"
    Heuristic match: "secure.ccleaner.com"
    Heuristic match: "service.piriform.com"
    Heuristic match: "shepherd.ff.avast.com"
    Heuristic match: "static-cf.cleverbridge.com"
    Heuristic match: "stats.g.doubleclick.net"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 258
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 306
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 320
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 312
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 276
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 297
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 289
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 295
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 287
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 374
    Host: analytics.ff.avast.com"
    Heuristic match: "POST /receive3 HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-enc-sb
    User-Agent: Avast Antivirus
    Content-Length: 335
    Host: analytics.ff.avast.com"
    Heuristic match: "GET /v2/info HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    User-Agent: CCleaner Update Agent
    Host: ip-info.ff.avast.com"
    Pattern match: "https://ipmcdn.avast.com/images/"
    Pattern match: "https://secure.ccleaner.com/502/purl-renewal%3fscope%3dcheckout%26cart%3ds6788%26x-renewal%3d1651513422"
    Pattern match: "https://secure.ccleaner.com/502/purl-renewal?scope=checkout&cart=s6788&x-renewal=1651513422,renewalQS:scope=checkout&cart=s6788&x-renewal=1651513422,isLegacy:1"
    Pattern match: "https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
    Pattern match: "https://secure.ccleaner.com/502/uurl-rvk592bi0y?x-source=1021&x-origin=6&x-variant=723&x-campaign=25"
    Pattern match: "https://secure.ccleaner.com"
    Pattern match: "http://ccleaner.tools.avcdn.net/tools/ccleaner/update/20180205.dll"
    Pattern match: "http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccprobe.cab"
    Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAonX%2BcE1u7LI"
    Pattern match: "www.ccleaner.com/"

    source

    File/Memory

    relevance

    10/10

  • HTTP request contains Base64 encoded artifacts

    details

    "S'HUcX"
    "]B?Ue}D>HF"
    "y@y>=<_|P"
    "zf=Gm"

    source

    Network Traffic

    relevance

    7/10

    ATT&CK ID

    T1132 (Show technique in the MITRE ATT&CK™ matrix)

• Spyware/Information Retrieval
  • Found a reference to a known community page

    details

    "GET /images/en/buttonPayPalExpress.gif HTTP/1.1
    Accept: */*
    Referer: https://secure.ccleaner.com/502/uurl-rvk592bi0y?x-source=1021&x-origin=6&x-variant=723&x-campaign=25
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
    Host: static-cf.cleverbridge.com
    Connection: Keep-Alive" (Indicator: "paypal")
    "GET /images/clientDefaultStyle/iconPaypal.png HTTP/1.1
    Accept: */*
    Referer: https://secure.ccleaner.com/502/uurl-rvk592bi0y?x-source=1021&x-origin=6&x-variant=723&x-campaign=25
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
    Host: static-cf.cleverbridge.com
    Connection: Keep-Alive" (Indicator: "paypal")

    source

    File/Memory

    relevance

    7/10

• System Security
  • Creates or modifies windows services

    details

    "ccsetup579pro.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
    "CCUpdate.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
    "CCleaner.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Opens the Kernel Security Device Driver (KsecDD) of Windows

    details

    "ccsetup579pro.exe" opened "\Device\KsecDD"
    "CCleaner.exe" opened "\Device\KsecDD"
    "CCUpdate.exe" opened "\Device\KsecDD"

    source

    API Call

    relevance

    10/10

    ATT&CK ID

    T1215 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "CCUpdate.exe.bin" was detected as "Visual C++ 2005 Release -> Microsoft"
    "lang-1040.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-2074.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1035.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1036.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1056.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1063.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1109.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "uninst.exe" was detected as "Nullsoft PiMP Stub -> SFX"
    "lang-1065.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-5146.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "e93cd9a7-7241-42b1-b1b4-27bcddd51fb0.dll" was detected as "Borland Delphi 3.0 (???)"
    "inetc.dll" was detected as "Microsoft visual C++ 6.0 DLL"
    "lang-3098.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1057.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1042.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-2052.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1031.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1026.dll" was detected as "Microsoft visual C++ vx.x DLL"
    "lang-1092.dll" was detected as "Microsoft visual C++ vx.x DLL"

    source

    Static Parser

    relevance

    10/10

    ATT&CK ID

    T1045 (Show technique in the MITRE ATT&CK™ matrix)

File Certificates

Certificate chain was successfully validated.

DNS Requests

Domain	Address	Registrar	Country
analytics.ff.avast.com OSINT Associated Artifacts for analytics.ff.avast.com Whois Field Value Address Budejovicka 1518/13a City Prague 4 Country CZ Creation Date 1997-10-06T00:00:00 Creation Date 1997-10-06T04:00:00 DNSSEC Unsigned Domain Name AVAST.COM EMail abuse@web.com EMail customerservice@networksolutions.com Expiration Date 2023-10-05T00:00:00 Expiration Date 2026-10-05T04:00:00 name AVAST Software a.s. Name Server NS2.AVAST.COM Name Server PNS.AVAST.COM Referral URL http://networksolutions.com Reigstrar NETWORK SOLUTIONS, LLC. Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2013-10-08T00:00:00 Last Update 2017-03-05T14:46:50 Whois Server whois.networksolutions.com Zip Code 140 00 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 Threat Level no verdict Positives - Scan Date 05/09/2021 08:51:58 Reference AlienVault 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 no verdict - 05/09/2021 08:51:58 AlienVault Associated SHA256 ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 Threat Level no verdict Positives - Scan Date 05/09/2021 08:38:58 Reference AlienVault ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 no verdict - 05/09/2021 08:38:58 AlienVault Associated SHA256 b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 Threat Level no verdict Positives - Scan Date 05/08/2021 06:20:12 Reference AlienVault b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 no verdict - 05/08/2021 06:20:12 AlienVault Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 a442b9fa2940329d6600cb8b46f131289eb141a6f78377055886cdb0de5f09ad Threat Level no verdict Positives - Scan Date 05/06/2021 03:24:28 Reference AlienVault a442b9fa2940329d6600cb8b46f131289eb141a6f78377055886cdb0de5f09ad no verdict - 05/06/2021 03:24:28 AlienVault	69.94.68.209 TTL: 168	NETWORK SOLUTIONS, LLC. Name Server: NS2.AVAST.COM Creation Date: 1997-10-06T00:00:00	Czech Republic
ccleaner.tools.avcdn.net OSINT Associated Artifacts for ccleaner.tools.avcdn.net Whois Field Value DNSSEC unsigned Domain Name AVCDN.NET Expiration Date 2017-10-31T00:00:00 name Petr Chocholous Name Server NS-A.AVCDN.NET Name Server NS-B.AVCDN.NET Organization Avast Software s.r.o. Referral URL http://www.godaddy.com Reigstrar GODADDY.COM, LLC Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2016-10-31T00:00:00 Whois Server whois.godaddy.com Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 Threat Level no verdict Positives - Scan Date 04/28/2021 20:20:02 Reference AlienVault 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 no verdict - 04/28/2021 20:20:02 AlienVault Associated SHA256 a36536162dea6f6144fdd0169366fb1757f8fb4f0de4e3032b5a554b07dbe99b Threat Level no verdict Positives - Scan Date 04/24/2021 14:47:24 Reference AlienVault a36536162dea6f6144fdd0169366fb1757f8fb4f0de4e3032b5a554b07dbe99b no verdict - 04/24/2021 14:47:24 AlienVault	104.114.76.138 TTL: 567	GODADDY.COM, LLC	United States
dev.visualwebsiteoptimizer.com OSINT Associated Artifacts for dev.visualwebsiteoptimizer.com Whois Field Value Address 74 Vidya Vihar Sector-9 City Rohini Country IN Creation Date 2009-11-13T00:00:00 Creation Date 2009-11-13T15:05:26 DNSSEC Unsigned Domain Name VISUALWEBSITEOPTIMIZER.COM EMail sparsh@wingify.com EMail abuse-contact@publicdomainregistry.com Expiration Date 2022-11-13T00:00:00 Expiration Date 2022-11-13T15:05:26 name Sparsh Gupta Name Server DNS1.P07.NSONE.NET Name Server DNS4.P07.NSONE.NET Referral URL http://www.publicdomainregistry.com Reigstrar PDR Ltd. d/b/a PublicDomainRegistry.com State Delhi Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Last Update 2015-03-16T00:00:00 Last Update 2016-11-29T12:23:33 Whois Server whois.publicdomainregistry.com Zip Code 110085 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 cb128d8aabe7b315f546d280017ff21e22328f0be39c8dd0e10132eb89236b5e Threat Level no verdict Positives - Scan Date 04/30/2021 20:25:12 Reference AlienVault cb128d8aabe7b315f546d280017ff21e22328f0be39c8dd0e10132eb89236b5e no verdict - 04/30/2021 20:25:12 AlienVault Associated SHA256 7e8324b741cfe022944a9dd089bacf8b891fff335025e05e48d7b9633c6e76f7 Threat Level no verdict Positives - Scan Date 04/22/2021 14:12:15 Reference AlienVault 7e8324b741cfe022944a9dd089bacf8b891fff335025e05e48d7b9633c6e76f7 no verdict - 04/22/2021 14:12:15 AlienVault Associated SHA256 3d774179fdb0f80687b11720c4fc5852b7a9b7e7a075fa6387efb1bff038b94e Threat Level no verdict Positives - Scan Date 04/13/2021 14:04:02 Reference AlienVault 3d774179fdb0f80687b11720c4fc5852b7a9b7e7a075fa6387efb1bff038b94e no verdict - 04/13/2021 14:04:02 AlienVault Associated SHA256 48c2271f31c0608294950b568a7df752926a3d6d7e9ae1c31abfb938d08360b1 Threat Level no verdict Positives - Scan Date 04/09/2021 10:35:49 Reference AlienVault 48c2271f31c0608294950b568a7df752926a3d6d7e9ae1c31abfb938d08360b1 no verdict - 04/09/2021 10:35:49 AlienVault Associated SHA256 03441329e2ef9ba5001830de24e9fb8a8f09de303d83847c7b689f3c9172cc45 Threat Level no verdict Positives - Scan Date 04/06/2021 13:08:30 Reference AlienVault 03441329e2ef9ba5001830de24e9fb8a8f09de303d83847c7b689f3c9172cc45 no verdict - 04/06/2021 13:08:30 AlienVault	34.96.102.137 TTL: 20703	PDR Ltd. d/b/a PublicDomainRegistry.com Name Server: DNS1.P07.NSONE.NET Creation Date: 2009-11-13T00:00:00	United States
emupdate.avcdn.net OSINT Associated Artifacts for emupdate.avcdn.net Whois Field Value DNSSEC unsigned Domain Name AVCDN.NET Expiration Date 2017-10-31T00:00:00 name Petr Chocholous Name Server NS-A.AVCDN.NET Name Server NS-B.AVCDN.NET Organization Avast Software s.r.o. Referral URL http://www.godaddy.com Reigstrar GODADDY.COM, LLC Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2016-10-31T00:00:00 Whois Server whois.godaddy.com Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 Threat Level no verdict Positives - Scan Date 04/28/2021 20:20:02 Reference AlienVault 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 no verdict - 04/28/2021 20:20:02 AlienVault Associated SHA256 a36536162dea6f6144fdd0169366fb1757f8fb4f0de4e3032b5a554b07dbe99b Threat Level no verdict Positives - Scan Date 04/24/2021 14:47:24 Reference AlienVault a36536162dea6f6144fdd0169366fb1757f8fb4f0de4e3032b5a554b07dbe99b no verdict - 04/24/2021 14:47:24 AlienVault	23.55.62.209 TTL: 729	GODADDY.COM, LLC	United States
ip-info.ff.avast.com OSINT Associated Artifacts for ip-info.ff.avast.com Whois Field Value Address Budejovicka 1518/13a City Prague 4 Country CZ Creation Date 1997-10-06T00:00:00 Creation Date 1997-10-06T04:00:00 DNSSEC Unsigned Domain Name AVAST.COM EMail abuse@web.com EMail customerservice@networksolutions.com Expiration Date 2023-10-05T00:00:00 Expiration Date 2026-10-05T04:00:00 name AVAST Software a.s. Name Server NS2.AVAST.COM Name Server PNS.AVAST.COM Referral URL http://networksolutions.com Reigstrar NETWORK SOLUTIONS, LLC. Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2013-10-08T00:00:00 Last Update 2017-03-05T14:46:50 Whois Server whois.networksolutions.com Zip Code 140 00 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f Threat Level no verdict Positives - Scan Date 05/02/2021 16:33:56 Reference AlienVault b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f no verdict - 05/02/2021 16:33:56 AlienVault Associated SHA256 6ae4f6ffcac09fa21126c67efe6e636a328c5e921a6b16826f4b72adb2501ba1 Threat Level no verdict Positives - Scan Date 04/30/2021 09:12:27 Reference AlienVault 6ae4f6ffcac09fa21126c67efe6e636a328c5e921a6b16826f4b72adb2501ba1 no verdict - 04/30/2021 09:12:27 AlienVault	5.62.48.19 TTL: 373	NETWORK SOLUTIONS, LLC. Name Server: NS2.AVAST.COM Creation Date: 1997-10-06T00:00:00	United Kingdom
ipm-provider.ff.avast.com OSINT Associated Artifacts for ipm-provider.ff.avast.com Whois Field Value Address Budejovicka 1518/13a City Prague 4 Country CZ Creation Date 1997-10-06T00:00:00 Creation Date 1997-10-06T04:00:00 DNSSEC Unsigned Domain Name AVAST.COM EMail abuse@web.com EMail customerservice@networksolutions.com Expiration Date 2023-10-05T00:00:00 Expiration Date 2026-10-05T04:00:00 name AVAST Software a.s. Name Server NS2.AVAST.COM Name Server PNS.AVAST.COM Referral URL http://networksolutions.com Reigstrar NETWORK SOLUTIONS, LLC. Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2013-10-08T00:00:00 Last Update 2017-03-05T14:46:50 Whois Server whois.networksolutions.com Zip Code 140 00 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 Threat Level no verdict Positives - Scan Date 05/09/2021 08:51:58 Reference AlienVault 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 no verdict - 05/09/2021 08:51:58 AlienVault Associated SHA256 ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 Threat Level no verdict Positives - Scan Date 05/09/2021 08:38:58 Reference AlienVault ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 no verdict - 05/09/2021 08:38:58 AlienVault Associated SHA256 e09cba714c003b6be9c6839fe167ef118107608c43f584368140c5e890b0a503 Threat Level no verdict Positives - Scan Date 05/04/2021 03:45:28 Reference AlienVault e09cba714c003b6be9c6839fe167ef118107608c43f584368140c5e890b0a503 no verdict - 05/04/2021 03:45:28 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f Threat Level no verdict Positives - Scan Date 05/02/2021 16:33:56 Reference AlienVault b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f no verdict - 05/02/2021 16:33:56 AlienVault	5.62.44.217 TTL: 476	NETWORK SOLUTIONS, LLC. Name Server: NS2.AVAST.COM Creation Date: 1997-10-06T00:00:00	United Kingdom
license-api.ccleaner.com OSINT Associated Artifacts for license-api.ccleaner.com Whois Field Value Creation Date 2004-05-13T00:00:00 DNSSEC unsigned Domain Name CCLEANER.COM Expiration Date 2018-01-01T00:00:00 name Registration Private Name Server NS-1031.AWSDNS-00.ORG Name Server NS-859.AWSDNS-43.NET Organization Domains By Proxy, LLC Referral URL http://www.godaddy.com Reigstrar GODADDY.COM, LLC Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2016-03-14T00:00:00 Whois Server whois.godaddy.com Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 Threat Level no verdict Positives - Scan Date 04/28/2021 20:20:02 Reference AlienVault 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 no verdict - 04/28/2021 20:20:02 AlienVault Associated SHA256 3271977ca1db972e6e4f6cf20e58610b311906a07706181dea16d33290412fdf Threat Level no verdict Positives - Scan Date 04/21/2021 18:54:12 Reference AlienVault 3271977ca1db972e6e4f6cf20e58610b311906a07706181dea16d33290412fdf no verdict - 04/21/2021 18:54:12 AlienVault Associated SHA256 8ca972c65f55334145a0ef4b782966a5abe0b709257d200b5875564fa07cb5e9 Threat Level no verdict Positives - Scan Date 04/17/2021 00:15:52 Reference AlienVault 8ca972c65f55334145a0ef4b782966a5abe0b709257d200b5875564fa07cb5e9 no verdict - 04/17/2021 00:15:52 AlienVault	54.204.119.115 TTL: 222	GODADDY.COM, LLC Organization: Domains By Proxy, LLC Name Server: NS-1031.AWSDNS-00.ORG Creation Date: 2004-05-13T00:00:00	United States
license.piriform.com OSINT Associated Artifacts for license.piriform.com Whois Field Value Creation Date 2005-02-26T00:00:00 DNSSEC unsigned Domain Name PIRIFORM.COM Expiration Date 2018-01-01T00:00:00 name Registration Private Name Server NS-128.AWSDNS-16.COM Name Server NS-547.AWSDNS-04.NET Organization Domains By Proxy, LLC Referral URL http://www.godaddy.com Reigstrar GODADDY.COM, LLC Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2016-03-14T00:00:00 Whois Server whois.godaddy.com Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 Threat Level no verdict Positives - Scan Date 04/01/2021 21:16:39 Reference AlienVault 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 no verdict - 04/01/2021 21:16:39 AlienVault Associated SHA256 f064d58490f0f60a1532b3067d00fc7eccb8252461ee441d863d57c1c39ed93f Threat Level no verdict Positives - Scan Date 03/06/2021 16:23:28 Reference AlienVault f064d58490f0f60a1532b3067d00fc7eccb8252461ee441d863d57c1c39ed93f no verdict - 03/06/2021 16:23:28 AlienVault Associated SHA256 6b6cb6ffd5962ff7c7aa03df3dd2214a472a47b15ca8f38a0608870f994b7fa7 Threat Level no verdict Positives - Scan Date 02/27/2021 02:42:35 Reference AlienVault 6b6cb6ffd5962ff7c7aa03df3dd2214a472a47b15ca8f38a0608870f994b7fa7 no verdict - 02/27/2021 02:42:35 AlienVault Associated SHA256 18248c04ba828d4b56581c8233560fd48e8ddccee92f7199e7e8b96bdb3806f9 Threat Level no verdict Positives - Scan Date 02/20/2021 17:02:08 Reference AlienVault 18248c04ba828d4b56581c8233560fd48e8ddccee92f7199e7e8b96bdb3806f9 no verdict - 02/20/2021 17:02:08 AlienVault	151.101.194.109 TTL: 96	GODADDY.COM, LLC Organization: Domains By Proxy, LLC Name Server: NS-128.AWSDNS-16.COM Creation Date: 2005-02-26T00:00:00	United States
ncc.avast.com OSINT Associated Artifacts for ncc.avast.com Whois Field Value Address Budejovicka 1518/13a City Prague 4 Country CZ Creation Date 1997-10-06T00:00:00 Creation Date 1997-10-06T04:00:00 DNSSEC Unsigned Domain Name AVAST.COM EMail abuse@web.com EMail customerservice@networksolutions.com Expiration Date 2023-10-05T00:00:00 Expiration Date 2026-10-05T04:00:00 name AVAST Software a.s. Name Server NS2.AVAST.COM Name Server PNS.AVAST.COM Referral URL http://networksolutions.com Reigstrar NETWORK SOLUTIONS, LLC. Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Last Update 2013-10-08T00:00:00 Last Update 2017-03-05T14:46:50 Whois Server whois.networksolutions.com Zip Code 140 00 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 Threat Level no verdict Positives - Scan Date 05/08/2021 06:20:12 Reference AlienVault b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 no verdict - 05/08/2021 06:20:12 AlienVault Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 0cbd94d07587aa8a6e84696f2c66b56e1aa070151e5f3fd40bfecaf6b20c2611 Threat Level no verdict Positives - Scan Date 05/05/2021 12:02:51 Reference AlienVault 0cbd94d07587aa8a6e84696f2c66b56e1aa070151e5f3fd40bfecaf6b20c2611 no verdict - 05/05/2021 12:02:51 AlienVault Associated SHA256 b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f Threat Level no verdict Positives - Scan Date 05/02/2021 16:33:56 Reference AlienVault b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f no verdict - 05/02/2021 16:33:56 AlienVault Associated SHA256 6ae4f6ffcac09fa21126c67efe6e636a328c5e921a6b16826f4b72adb2501ba1 Threat Level no verdict Positives - Scan Date 04/30/2021 09:12:27 Reference AlienVault 6ae4f6ffcac09fa21126c67efe6e636a328c5e921a6b16826f4b72adb2501ba1 no verdict - 04/30/2021 09:12:27 AlienVault	23.62.230.104 TTL: 847	NETWORK SOLUTIONS, LLC. Name Server: NS2.AVAST.COM Creation Date: 1997-10-06T00:00:00	United States
ocsp.pki.goog	216.58.194.163 TTL: 106	-	United States
ocsp.starfieldtech.com	192.124.249.24 TTL: 1206	-	United States
seal.digicert.com	54.201.108.228 TTL: 80	-	United States
secure.ccleaner.com	104.16.243.229 TTL: 299	-	United States
service.piriform.com	151.101.128.64 TTL: 299	-	United States
shepherd.ff.avast.com	5.62.48.205 TTL: 195	-	United Kingdom
static-cf.cleverbridge.com	104.16.243.229 TTL: 299	-	United States
stats.g.doubleclick.net	142.250.141.155 TTL: 17892	-	United States
www.ccleaner.com	151.101.2.202 TTL: 40	-	United States

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
69.94.68.202 OSINT Associated Artifacts for 69.94.68.202 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 Threat Level no verdict Positives - Scan Date 05/08/2021 06:20:12 Reference AlienVault b3c967775a8578b0cd3ec94772817a11429688a99833fd63ca70fa5d73d0d422 no verdict - 05/08/2021 06:20:12 AlienVault Associated SHA256 b497616706d028014b0eb9f5974084a64618373c702bc4dc3b2f435ab86ad5cd Threat Level no verdict Positives - Scan Date 05/05/2021 12:05:41 Reference AlienVault b497616706d028014b0eb9f5974084a64618373c702bc4dc3b2f435ab86ad5cd no verdict - 05/05/2021 12:05:41 AlienVault Associated SHA256 0cbd94d07587aa8a6e84696f2c66b56e1aa070151e5f3fd40bfecaf6b20c2611 Threat Level no verdict Positives - Scan Date 05/05/2021 12:02:51 Reference AlienVault 0cbd94d07587aa8a6e84696f2c66b56e1aa070151e5f3fd40bfecaf6b20c2611 no verdict - 05/05/2021 12:02:51 AlienVault Associated SHA256 1b8bd81e0f478867808f789de6b2a34807291ee1abe42ad889bcc43e02934118 Threat Level no verdict Positives - Scan Date 05/04/2021 09:13:27 Reference AlienVault 1b8bd81e0f478867808f789de6b2a34807291ee1abe42ad889bcc43e02934118 no verdict - 05/04/2021 09:13:27 AlienVault Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain aphb.cloud.avg.com Threat Level - Positives - Last Resolved 04/30/2021 21:22:01 VirusTotal Report aphb.cloud.avg.com - - 04/30/2021 21:22:01 Report Domain lc.stats.avast.com Threat Level - Positives - Last Resolved 10/28/2020 18:08:58 VirusTotal Report lc.stats.avast.com - - 10/28/2020 18:08:58 Report Domain sd-7.cloud.avg.com Threat Level - Positives - Last Resolved 10/28/2020 16:33:12 VirusTotal Report sd-7.cloud.avg.com - - 10/28/2020 16:33:12 Report Domain ashine2acxhb.cloud.avg.com Threat Level - Positives - Last Resolved 10/27/2020 11:17:02 VirusTotal Report ashine2acxhb.cloud.avg.com - - 10/27/2020 11:17:02 Report Domain asu.aa.avast.com Threat Level - Positives - Last Resolved 09/11/2020 14:48:40 VirusTotal Report asu.aa.avast.com - - 09/11/2020 14:48:40 Report Show SSL	443 TCP	ccsetup579pro.exe PID: 3664	Czech Republic
151.101.0.64 OSINT Associated Artifacts for 151.101.0.64 Details Associated URL Threat Level Positives Scan Date Reference Associated URL https://disq.us/?url=https://www.gepard.ru/login/account/&key=JgDq7zS0rAtd6srC39cdig Threat Level malicious Positives 3/87 Scan Date 05/15/2021 00:38:35 Reference - https://disq.us/?url=https://www.gepard.ru/login/account/&key=JgDq7zS0rAtd6srC39cdig malicious 3/87 05/15/2021 00:38:35 - Associated URL http://disq.us/?url=http://v32vi.org/obj/x86/Debug/Debug.html&key=p5-unr13EF1NVPWeoA4G6Q Threat Level malicious Positives 4/87 Scan Date 05/14/2021 04:18:45 Reference - http://disq.us/?url=http://v32vi.org/obj/x86/Debug/Debug.html&key=p5-unr13EF1NVPWeoA4G6Q malicious 4/87 05/14/2021 04:18:45 - Associated URL https://disq.us/?url=https://myhomeworkassist.com/account/login/onreviwer/index.php&key=kv2WmfkLF63hQipJmKu0UA Threat Level malicious Positives 2/87 Scan Date 05/12/2021 07:03:44 Reference - https://disq.us/?url=https://myhomeworkassist.com/account/login/onreviwer/index.php&key=kv2WmfkLF63hQipJmKu0UA malicious 2/87 05/12/2021 07:03:44 - Associated URL https://disq.us/?url=https://www.adelaidetowingandcarremoval.com.au/wp-content//uploads/2020/socialsecurity/&key=yxyB8SwN1ZZJw8BCaTGrjw Threat Level malicious Positives 2/87 Scan Date 05/10/2021 12:48:49 Reference - https://disq.us/?url=https://www.adelaidetowingandcarremoval.com.au/wp-content//uploads/2020/socialsecurity/&key=yxyB8SwN1ZZJw8BCaTGrjw malicious 2/87 05/10/2021 12:48:49 - Associated URL http://disq.us/?url=http://www.rmiembassyus.org/media/jui/js/&key=i5ElDKzVfYplZuUVH2XYTg Threat Level malicious Positives 3/87 Scan Date 05/10/2021 02:43:49 Reference - http://disq.us/?url=http://www.rmiembassyus.org/media/jui/js/&key=i5ElDKzVfYplZuUVH2XYTg malicious 3/87 05/10/2021 02:43:49 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 Threat Level no verdict Positives - Scan Date 04/28/2021 20:20:02 Reference AlienVault 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 no verdict - 04/28/2021 20:20:02 AlienVault Associated SHA256 b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a Threat Level no verdict Positives - Scan Date 03/17/2021 14:40:22 Reference AlienVault b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a no verdict - 03/17/2021 14:40:22 AlienVault Associated SHA256 ec35b95c66cc7ede7b7c2cf5dbeea377606af4f829e2db919c0a4856309215b9 Threat Level no verdict Positives - Scan Date 02/11/2021 10:57:33 Reference AlienVault ec35b95c66cc7ede7b7c2cf5dbeea377606af4f829e2db919c0a4856309215b9 no verdict - 02/11/2021 10:57:33 AlienVault Associated SHA256 01192c46d30e1313297e0e40a7e3884e7f3066a73bdad5cb482898380f5408e7 Threat Level malicious Positives 2/75 Scan Date 07/24/2020 09:52:11 Reference VirusTotal 01192c46d30e1313297e0e40a7e3884e7f3066a73bdad5cb482898380f5408e7 malicious 2/75 07/24/2020 09:52:11 VirusTotal Associated SHA256 96bdd92edc727dcf1038474964037dad6a8fd61545a10a77470c2c9fe3a61460 Threat Level malicious Positives 4/71 Scan Date 11/02/2019 07:36:43 Reference VirusTotal 96bdd92edc727dcf1038474964037dad6a8fd61545a10a77470c2c9fe3a61460 malicious 4/71 11/02/2019 07:36:43 VirusTotal Associated SHA256 a04b29847dbedbfb9022df6936c6842952e58799a541e99e955673e202ce4b15 Threat Level suspicious Positives 1/72 Scan Date 10/20/2019 12:55:48 Reference VirusTotal a04b29847dbedbfb9022df6936c6842952e58799a541e99e955673e202ce4b15 suspicious 1/72 10/20/2019 12:55:48 VirusTotal Associated SHA256 9724e635628a1b5c10443b6e38ae1352a13a0578f43b0f7f09fed90c67ba779f Threat Level malicious Positives 4/72 Scan Date 09/12/2019 22:20:04 Reference VirusTotal 9724e635628a1b5c10443b6e38ae1352a13a0578f43b0f7f09fed90c67ba779f malicious 4/72 09/12/2019 22:20:04 VirusTotal Associated SHA256 6f4f01c4865de76c86027fa5b62feefbde3ff3ac8f090fafe48e52b6f6c95340 Threat Level suspicious Positives 1/61 Scan Date 10/02/2018 03:10:45 Reference VirusTotal 6f4f01c4865de76c86027fa5b62feefbde3ff3ac8f090fafe48e52b6f6c95340 suspicious 1/61 10/02/2018 03:10:45 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain test.fastly-debug.com Threat Level - Positives - Last Resolved 05/01/2021 10:16:15 VirusTotal Report test.fastly-debug.com - - 05/01/2021 10:16:15 Report Domain i.businessinsider.com Threat Level - Positives - Last Resolved 03/24/2021 18:50:09 VirusTotal Report i.businessinsider.com - - 03/24/2021 18:50:09 Report Domain c1-mid.adis.ws Threat Level - Positives - Last Resolved 03/18/2021 12:48:18 VirusTotal Report c1-mid.adis.ws - - 03/18/2021 12:48:18 Report Domain dam-live-stream-api.adis.ws Threat Level - Positives - Last Resolved 03/18/2021 12:44:17 VirusTotal Report dam-live-stream-api.adis.ws - - 03/18/2021 12:44:17 Report Domain i1-mid.adis.ws Threat Level - Positives - Last Resolved 03/18/2021 12:41:50 VirusTotal Report i1-mid.adis.ws - - 03/18/2021 12:41:50 Report Show SSL	443 TCP	ccsetup579pro.exe PID: 3664	United States
54.204.119.115 OSINT Associated Artifacts for 54.204.119.115 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 Threat Level no verdict Positives - Scan Date 05/03/2021 21:54:06 Reference AlienVault 6bf18ad65039078c44b5a570a4f8c9d29403a6135d5d99763b8b6e30c8a3bc59 no verdict - 05/03/2021 21:54:06 AlienVault Associated SHA256 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 Threat Level no verdict Positives - Scan Date 04/28/2021 20:20:02 Reference AlienVault 9071b1b4fa0bf71e92d36501236a39a3e8866fd840c1f6aad58ffbb9b54e23a6 no verdict - 04/28/2021 20:20:02 AlienVault Associated SHA256 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 Threat Level no verdict Positives - Scan Date 04/01/2021 21:16:39 Reference AlienVault 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 no verdict - 04/01/2021 21:16:39 AlienVault Associated SHA256 33f61a69ea8a4902ad14ea56293e005c5a57482cce7fbfd84d509814cf9d653e Threat Level no verdict Positives - Scan Date 03/30/2021 01:55:42 Reference AlienVault 33f61a69ea8a4902ad14ea56293e005c5a57482cce7fbfd84d509814cf9d653e no verdict - 03/30/2021 01:55:42 AlienVault Associated SHA256 b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a Threat Level no verdict Positives - Scan Date 03/17/2021 14:40:22 Reference AlienVault b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a no verdict - 03/17/2021 14:40:22 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain license-apis-production-1499952566.us-east-1.elb.amazonaws.com Threat Level - Positives - Last Resolved 12/28/2020 09:59:39 VirusTotal Report license-apis-production-1499952566.us-east-1.elb.amazonaws.com - - 12/28/2020 09:59:39 Report Domain license-api.ccleaner.com Threat Level - Positives - Last Resolved 12/23/2020 05:30:01 VirusTotal Report license-api.ccleaner.com - - 12/23/2020 05:30:01 Report Domain velaskec.ca Threat Level - Positives - Last Resolved 11/17/2020 02:02:22 VirusTotal Report velaskec.ca - - 11/17/2020 02:02:22 Report Show SSL	443 TCP	ccsetup579pro.exe PID: 3664	United States
5.62.44.49 OSINT Associated Artifacts for 5.62.44.49 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 2c11d40b1fcb37bf30b5cfe0f5e262daa2649e6ded19046b9aea7d20a50408c2 Threat Level no verdict Positives - Scan Date 04/29/2021 04:29:18 Reference AlienVault 2c11d40b1fcb37bf30b5cfe0f5e262daa2649e6ded19046b9aea7d20a50408c2 no verdict - 04/29/2021 04:29:18 AlienVault Associated SHA256 a990fb414ec926894b34602f4a0cd21ea3cd4a8e55871c63ffa2ca514d75e5da Threat Level no verdict Positives - Scan Date 04/29/2021 04:29:05 Reference AlienVault a990fb414ec926894b34602f4a0cd21ea3cd4a8e55871c63ffa2ca514d75e5da no verdict - 04/29/2021 04:29:05 AlienVault Associated SHA256 11dd8d58f928449bf2abd4252b3b085c2da746a28d221224e1cc2b7ae6b37ed6 Threat Level no verdict Positives - Scan Date 04/29/2021 04:24:24 Reference AlienVault 11dd8d58f928449bf2abd4252b3b085c2da746a28d221224e1cc2b7ae6b37ed6 no verdict - 04/29/2021 04:24:24 AlienVault Associated SHA256 73739ebbf36db94251aa82f48177245c50b6de35240c78ca440e6113bcfc98ee Threat Level no verdict Positives - Scan Date 04/05/2021 12:37:05 Reference AlienVault 73739ebbf36db94251aa82f48177245c50b6de35240c78ca440e6113bcfc98ee no verdict - 04/05/2021 12:37:05 AlienVault Associated SHA256 588e5ccfa5cbb8346f4b095d14e1fa793d71e93420bb5417799ceb3b233fa7a0 Threat Level no verdict Positives - Scan Date 03/07/2021 19:20:46 Reference AlienVault 588e5ccfa5cbb8346f4b095d14e1fa793d71e93420bb5417799ceb3b233fa7a0 no verdict - 03/07/2021 19:20:46 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain shepherd.avcdn.net Threat Level - Positives - Last Resolved 12/12/2019 14:08:52 VirusTotal Report shepherd.avcdn.net - - 12/12/2019 14:08:52 Report Domain shepherd.ff.avast.com Threat Level - Positives - Last Resolved 12/07/2019 23:54:18 VirusTotal Report shepherd.ff.avast.com - - 12/07/2019 23:54:18 Report Domain shepherd.ns1.ff.avast.com Threat Level - Positives - Last Resolved 11/30/2019 17:42:13 VirusTotal Report shepherd.ns1.ff.avast.com - - 11/30/2019 17:42:13 Report	443 TCP	ccsetup579pro.exe PID: 3664	United Kingdom
69.94.68.200 OSINT Associated Artifacts for 69.94.68.200 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 799ed4dd65fc5dca28a85b884ee20860e771ef221111ec9bbbd04d07319ea074 Threat Level no verdict Positives - Scan Date 05/11/2021 07:03:20 Reference AlienVault 799ed4dd65fc5dca28a85b884ee20860e771ef221111ec9bbbd04d07319ea074 no verdict - 05/11/2021 07:03:20 AlienVault Associated SHA256 8dece7881b9ee63e5e600242fb699b047b7a5ba5d3964bd8a1372924dc84535a Threat Level no verdict Positives - Scan Date 05/09/2021 08:41:08 Reference AlienVault 8dece7881b9ee63e5e600242fb699b047b7a5ba5d3964bd8a1372924dc84535a no verdict - 05/09/2021 08:41:08 AlienVault Associated SHA256 ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 Threat Level no verdict Positives - Scan Date 05/09/2021 08:38:58 Reference AlienVault ce802a90b857184bce9a76d03f3c26be696605892d899f931982143c40ae1839 no verdict - 05/09/2021 08:38:58 AlienVault Associated SHA256 09602c2dc165452f64c6225840b9880b4fa3cbee47f23d3d37f6503464b7e1ab Threat Level no verdict Positives - Scan Date 05/02/2021 01:35:31 Reference AlienVault 09602c2dc165452f64c6225840b9880b4fa3cbee47f23d3d37f6503464b7e1ab no verdict - 05/02/2021 01:35:31 AlienVault Associated SHA256 39e4c11bf4e5db26d6fc585d82ba7b427f182e201e45ec45ec72dea86e91b3a7 Threat Level no verdict Positives - Scan Date 04/23/2021 00:30:53 Reference AlienVault 39e4c11bf4e5db26d6fc585d82ba7b427f182e201e45ec45ec72dea86e91b3a7 no verdict - 04/23/2021 00:30:53 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain stats.avcdn.netv7event.stats.avcdn.net Threat Level - Positives - Last Resolved 01/19/2021 12:31:03 VirusTotal Report stats.avcdn.netv7event.stats.avcdn.net - - 01/19/2021 12:31:03 Report Domain lc.stats.avast.com Threat Level - Positives - Last Resolved 10/28/2020 18:08:58 VirusTotal Report lc.stats.avast.com - - 10/28/2020 18:08:58 Report Domain avanzoacxhb.cloud.avg.com Threat Level - Positives - Last Resolved 10/27/2020 11:21:52 VirusTotal Report avanzoacxhb.cloud.avg.com - - 10/27/2020 11:21:52 Report Domain dntshb.cloud.avg.com Threat Level - Positives - Last Resolved 10/27/2020 11:19:52 VirusTotal Report dntshb.cloud.avg.com - - 10/27/2020 11:19:52 Report Domain isvpnhb.cloud.avg.com Threat Level - Positives - Last Resolved 10/27/2020 11:21:42 VirusTotal Report isvpnhb.cloud.avg.com - - 10/27/2020 11:21:42 Report Show SSL	443 TCP	ccsetup579pro.exe PID: 3664 ccleaner.exe PID: 2040 ccleaner.exe PID: 2564 ccleaner.exe PID: 1340 ccleaner.exe PID: 3740	Czech Republic
5.62.38.20 OSINT Associated Artifacts for 5.62.38.20 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 Threat Level no verdict Positives - Scan Date 05/06/2021 21:38:20 Reference AlienVault e3553ca9eb945ee9be70214b7358882219f4a564038b18a48552603b5e6950d4 no verdict - 05/06/2021 21:38:20 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 3fcdfcb8e1e91d5dbf8fe645313c149e661de3c8451e1777fee17d530f466c12 Threat Level no verdict Positives - Scan Date 03/17/2021 14:43:22 Reference AlienVault 3fcdfcb8e1e91d5dbf8fe645313c149e661de3c8451e1777fee17d530f466c12 no verdict - 03/17/2021 14:43:22 AlienVault Associated SHA256 b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a Threat Level no verdict Positives - Scan Date 03/17/2021 14:40:22 Reference AlienVault b4c425b307ed2b1d76eb1803c04a2fc6e486c99a6263d817a16000b3beabab2a no verdict - 03/17/2021 14:40:22 AlienVault Associated SHA256 1251adbf2058cb03bcc239402821e779f6404704b53e19f8e727f76dd0cdcad1 Threat Level no verdict Positives - Scan Date 03/03/2021 13:10:06 Reference AlienVault 1251adbf2058cb03bcc239402821e779f6404704b53e19f8e727f76dd0cdcad1 no verdict - 03/03/2021 13:10:06 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain ip-info.ff.avast.com Threat Level - Positives - Last Resolved 07/29/2020 08:44:50 VirusTotal Report ip-info.ff.avast.com - - 07/29/2020 08:44:50 Report Domain geoip.hmageo.com Threat Level - Positives - Last Resolved 11/29/2019 16:53:00 VirusTotal Report geoip.hmageo.com - - 11/29/2019 16:53:00 Report Domain ip.ff.avast.com Threat Level - Positives - Last Resolved 11/20/2019 18:43:32 VirusTotal Report ip.ff.avast.com - - 11/20/2019 18:43:32 Report Domain ip-info.ns1.ff.avast.com Threat Level - Positives - Last Resolved 09/04/2019 12:53:19 VirusTotal Report ip-info.ns1.ff.avast.com - - 09/04/2019 12:53:19 Report Show SSL	443 TCP	ccupdate.exe PID: 332 ccupdate.exe PID: 2172 ccleaner.exe PID: 2040	United Kingdom
23.55.62.209 OSINT Associated Artifacts for 23.55.62.209 Details Domain Threat Level Positives Last Resolved Reference Domain a1874.dscw73.akamai.net Threat Level - Positives - Last Resolved 05/11/2021 08:38:48 VirusTotal Report a1874.dscw73.akamai.net - - 05/11/2021 08:38:48 Report Domain opgg-desktop-patch.akamaized.net Threat Level - Positives - Last Resolved 05/11/2021 08:56:44 VirusTotal Report opgg-desktop-patch.akamaized.net - - 05/11/2021 08:56:44 Report Domain storelens.sk Threat Level - Positives - Last Resolved 05/11/2021 14:23:50 VirusTotal Report storelens.sk - - 05/11/2021 14:23:50 Report Domain api.detectioneng.com Threat Level - Positives - Last Resolved 05/09/2021 01:20:39 VirusTotal Report api.detectioneng.com - - 05/09/2021 01:20:39 Report Domain ciudaddeorlando.net Threat Level - Positives - Last Resolved 05/08/2021 13:43:38 VirusTotal Report ciudaddeorlando.net - - 05/08/2021 13:43:38 Report	80 TCP	ccupdate.exe PID: 332	United States
23.55.62.147 OSINT Associated Artifacts for 23.55.62.147 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://d3.spintop-media.com/tmdls/ Threat Level malicious Positives 3/71 Scan Date 01/10/2020 01:50:16 Reference - http://d3.spintop-media.com/tmdls/ malicious 3/71 01/10/2020 01:50:16 - Details Domain Threat Level Positives Last Resolved Reference Domain hmkids.shop Threat Level - Positives - Last Resolved 05/11/2021 13:14:52 VirusTotal Report hmkids.shop - - 05/11/2021 13:14:52 Report Domain itsapark.kr Threat Level - Positives - Last Resolved 05/11/2021 13:42:07 VirusTotal Report itsapark.kr - - 05/11/2021 13:42:07 Report Domain kinepolis.nl Threat Level - Positives - Last Resolved 05/11/2021 14:25:28 VirusTotal Report kinepolis.nl - - 05/11/2021 14:25:28 Report Domain storelens.shopping Threat Level - Positives - Last Resolved 05/10/2021 14:09:55 VirusTotal Report storelens.shopping - - 05/10/2021 14:09:55 Report Domain hm.sale Threat Level - Positives - Last Resolved 05/09/2021 13:11:37 VirusTotal Report hm.sale - - 05/09/2021 13:11:37 Report	80 TCP	ccleaner.exe PID: 2040	United States
5.62.48.213 OSINT Associated Artifacts for 5.62.48.213 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 7960dc1636422ae760d68648564efcb14ddd6adb22971efc8f007d8801c824df Threat Level no verdict Positives - Scan Date 05/04/2020 18:27:36 Reference AlienVault 7960dc1636422ae760d68648564efcb14ddd6adb22971efc8f007d8801c824df no verdict - 05/04/2020 18:27:36 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain s.program.avast.com Threat Level - Positives - Last Resolved 01/07/2021 04:57:26 VirusTotal Report s.program.avast.com - - 01/07/2021 04:57:26 Report Domain welcome-safezone.avast.com Threat Level - Positives - Last Resolved 11/10/2020 11:05:35 VirusTotal Report welcome-safezone.avast.com - - 11/10/2020 11:05:35 Report Domain ipm-provider.ns1.ff.avast.com Threat Level - Positives - Last Resolved 12/15/2019 10:32:31 VirusTotal Report ipm-provider.ns1.ff.avast.com - - 12/15/2019 10:32:31 Report Domain ipm-provider.ff.avast.com Threat Level - Positives - Last Resolved 11/13/2019 01:56:46 VirusTotal Report ipm-provider.ff.avast.com - - 11/13/2019 01:56:46 Report Domain program.avast.com Threat Level - Positives - Last Resolved 11/12/2019 16:02:39 VirusTotal Report program.avast.com - - 11/12/2019 16:02:39 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United Kingdom
151.101.2.202 OSINT Associated Artifacts for 151.101.2.202 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://dreamhost.com/ Threat Level suspicious Positives 1/83 Scan Date 01/13/2021 07:08:35 Reference - http://dreamhost.com/ suspicious 1/83 01/13/2021 07:08:35 - Associated URL http://dreamhost.com/add_list.cgi Threat Level suspicious Positives 1/79 Scan Date 09/09/2020 20:21:22 Reference - http://dreamhost.com/add_list.cgi suspicious 1/79 09/09/2020 20:21:22 - Associated URL https://dreamhost.com/blog/how-to-create-linkedin-company-page Threat Level suspicious Positives 1/78 Scan Date 09/01/2020 02:44:04 Reference - https://dreamhost.com/blog/how-to-create-linkedin-company-page suspicious 1/78 09/01/2020 02:44:04 - Associated URL https://www.ozmall.co.jp/wedding/shop/ToHP.aspx?contractID=2371&url=http://inx.lv/Q6NK Threat Level suspicious Positives 1/79 Scan Date 07/20/2020 19:55:12 Reference - https://www.ozmall.co.jp/wedding/shop/ToHP.aspx?contractID=2371&url=http://inx.lv/Q6NK suspicious 1/79 07/20/2020 19:55:12 - Associated URL https://www.kickstarter.com/projects/chaddichor/932679064?ref=34etao&token=3bc20b68 Threat Level suspicious Positives 1/80 Scan Date 05/12/2020 12:02:27 Reference - https://www.kickstarter.com/projects/chaddichor/932679064?ref=34etao&token=3bc20b68 suspicious 1/80 05/12/2020 12:02:27 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 Threat Level no verdict Positives - Scan Date 05/09/2021 08:51:58 Reference AlienVault 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 no verdict - 05/09/2021 08:51:58 AlienVault Associated SHA256 17d7836be3c0424c8657cd8dbe0bdb68916aa0d8871235737c7cf96c3b3e6865 Threat Level no verdict Positives - Scan Date 05/05/2021 15:33:40 Reference AlienVault 17d7836be3c0424c8657cd8dbe0bdb68916aa0d8871235737c7cf96c3b3e6865 no verdict - 05/05/2021 15:33:40 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f Threat Level no verdict Positives - Scan Date 05/02/2021 16:33:56 Reference AlienVault b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f no verdict - 05/02/2021 16:33:56 AlienVault Associated SHA256 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 Threat Level no verdict Positives - Scan Date 04/01/2021 21:16:39 Reference AlienVault 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 no verdict - 04/01/2021 21:16:39 AlienVault Associated SHA256 57d6bbc5af70b33d07d67dd217037770addfa508b73b60d1be632fed45e4d4dd Threat Level suspicious Positives 1/75 Scan Date 12/06/2020 15:19:07 Reference VirusTotal 57d6bbc5af70b33d07d67dd217037770addfa508b73b60d1be632fed45e4d4dd suspicious 1/75 12/06/2020 15:19:07 VirusTotal Associated SHA256 f500da5c08ff1f022384f35462c981d52c5de70267618a4508d2607f1a507427 Threat Level suspicious Positives 1/71 Scan Date 07/30/2019 04:28:43 Reference VirusTotal f500da5c08ff1f022384f35462c981d52c5de70267618a4508d2607f1a507427 suspicious 1/71 07/30/2019 04:28:43 VirusTotal Associated SHA256 061d81ad0f436635e00a9ff6fe2e4c244212cea33935648edbf1dc55874fcd35 Threat Level malicious Positives 2/72 Scan Date 06/06/2019 09:51:06 Reference VirusTotal 061d81ad0f436635e00a9ff6fe2e4c244212cea33935648edbf1dc55874fcd35 malicious 2/72 06/06/2019 09:51:06 VirusTotal Associated SHA256 e2f325797fbe214056c3859b346a6a122caa3e191e421477b1b627d0f386bd21 Threat Level malicious Positives 2/66 Scan Date 04/27/2019 08:11:45 Reference VirusTotal e2f325797fbe214056c3859b346a6a122caa3e191e421477b1b627d0f386bd21 malicious 2/66 04/27/2019 08:11:45 VirusTotal Associated SHA256 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 Threat Level suspicious Positives 1/57 Scan Date 01/23/2019 09:26:46 Reference VirusTotal 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 suspicious 1/57 01/23/2019 09:26:46 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain fastly.tubi-staging.video Threat Level - Positives - Last Resolved 03/09/2021 00:20:38 VirusTotal Report fastly.tubi-staging.video - - 03/09/2021 00:20:38 Report Domain fastly.tubi.video Threat Level - Positives - Last Resolved 02/28/2021 03:41:23 VirusTotal Report fastly.tubi.video - - 02/28/2021 03:41:23 Report Domain fastly2.tubi.video Threat Level - Positives - Last Resolved 02/28/2021 03:41:23 VirusTotal Report fastly2.tubi.video - - 02/28/2021 03:41:23 Report Domain cache-static-rakugaki.sqex-edge.jp Threat Level - Positives - Last Resolved 01/28/2021 10:35:04 VirusTotal Report cache-static-rakugaki.sqex-edge.jp - - 01/28/2021 10:35:04 Report Domain api.merpay.ninja Threat Level - Positives - Last Resolved 01/27/2021 13:41:02 VirusTotal Report api.merpay.ninja - - 01/27/2021 13:41:02 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
151.101.2.109 OSINT Associated Artifacts for 151.101.2.109 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://151.101.2.109/ Threat Level suspicious Positives 1/87 Scan Date 05/14/2021 01:04:12 Reference - http://151.101.2.109/ suspicious 1/87 05/14/2021 01:04:12 - Associated URL https://m.emuparadise.me/emulators/files/ Threat Level suspicious Positives 1/85 Scan Date 03/22/2021 03:22:15 Reference - https://m.emuparadise.me/emulators/files/ suspicious 1/85 03/22/2021 03:22:15 - Associated URL https://www.emuparadise.me/emulators/files/user/EmuCR-Pcsxr-r72232-535.7z Threat Level suspicious Positives 1/85 Scan Date 03/21/2021 12:00:13 Reference - https://www.emuparadise.me/emulators/files/user/EmuCR-Pcsxr-r72232-535.7z suspicious 1/85 03/21/2021 12:00:13 - Associated URL https://m.emuparadise.me/emulators/files/user/ps2%20fceultra_0.9.3-358.zip Threat Level suspicious Positives 1/83 Scan Date 02/11/2021 18:47:11 Reference - https://m.emuparadise.me/emulators/files/user/ps2%20fceultra_0.9.3-358.zip suspicious 1/83 02/11/2021 18:47:11 - Associated URL http://m.emuparadise.me/roms/systems-amp.php?sysid=32 Threat Level suspicious Positives 1/80 Scan Date 11/09/2020 16:19:06 Reference - http://m.emuparadise.me/roms/systems-amp.php?sysid=32 suspicious 1/80 11/09/2020 16:19:06 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 70ec76badad579ae140168c23e8aa70a57eaf7caaa4993ee7b5bb18cd423a9df Threat Level no verdict Positives - Scan Date 05/10/2021 14:43:46 Reference AlienVault 70ec76badad579ae140168c23e8aa70a57eaf7caaa4993ee7b5bb18cd423a9df no verdict - 05/10/2021 14:43:46 AlienVault Associated SHA256 1d9f1683f0e8ed247ea3950cb07ba1cdafd76fdad20080b08c2dc280310efafe Threat Level no verdict Positives - Scan Date 05/04/2021 05:39:05 Reference AlienVault 1d9f1683f0e8ed247ea3950cb07ba1cdafd76fdad20080b08c2dc280310efafe no verdict - 05/04/2021 05:39:05 AlienVault Associated SHA256 8e01972712663e1d5484492515068af7ec973c906d3948b379dead63ae0884a2 Threat Level no verdict Positives - Scan Date 04/28/2021 21:00:34 Reference AlienVault 8e01972712663e1d5484492515068af7ec973c906d3948b379dead63ae0884a2 no verdict - 04/28/2021 21:00:34 AlienVault Associated SHA256 8dc657f3e5e9ca41602247e3cae6346a08382248ba729e3749ed905b26769c56 Threat Level no verdict Positives - Scan Date 04/16/2021 16:51:19 Reference AlienVault 8dc657f3e5e9ca41602247e3cae6346a08382248ba729e3749ed905b26769c56 no verdict - 04/16/2021 16:51:19 AlienVault Associated SHA256 a0834979432dac305e0ff255c42ab4b5ba532b0d3379c2ffbe39383842642306 Threat Level no verdict Positives - Scan Date 04/14/2021 14:50:01 Reference AlienVault a0834979432dac305e0ff255c42ab4b5ba532b0d3379c2ffbe39383842642306 no verdict - 04/14/2021 14:50:01 AlienVault Associated SHA256 45c9a32bf9e3afc8772f62d633c59bb8442d93c8a6cd68cf504674da26cbc369 Threat Level suspicious Positives 1/74 Scan Date 04/02/2021 02:04:54 Reference VirusTotal 45c9a32bf9e3afc8772f62d633c59bb8442d93c8a6cd68cf504674da26cbc369 suspicious 1/74 04/02/2021 02:04:54 VirusTotal Associated SHA256 3f831ca28b797320825e4dff96f2e7c937daadcb175918306bf466e03afcf0a5 Threat Level suspicious Positives 1/75 Scan Date 08/10/2020 12:21:58 Reference VirusTotal 3f831ca28b797320825e4dff96f2e7c937daadcb175918306bf466e03afcf0a5 suspicious 1/75 08/10/2020 12:21:58 VirusTotal Associated SHA256 d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 Threat Level suspicious Positives 1/74 Scan Date 06/04/2020 21:52:58 Reference VirusTotal d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 suspicious 1/74 06/04/2020 21:52:58 VirusTotal Associated SHA256 46e1a7ad3dc9c75763440c153465cdccc9a3ba367e3158542953ece4bcdb7b4f Threat Level malicious Positives 3/74 Scan Date 05/22/2020 14:34:15 Reference VirusTotal 46e1a7ad3dc9c75763440c153465cdccc9a3ba367e3158542953ece4bcdb7b4f malicious 3/74 05/22/2020 14:34:15 VirusTotal Associated SHA256 173fe71b45998cba39f596daf4afcad7a0dcfa7ff0a1f3f7a77bca9e44b78a0e Threat Level suspicious Positives 1/74 Scan Date 04/10/2020 19:43:31 Reference VirusTotal 173fe71b45998cba39f596daf4afcad7a0dcfa7ff0a1f3f7a77bca9e44b78a0e suspicious 1/74 04/10/2020 19:43:31 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain cdn-hcp.lumosity.com Threat Level - Positives - Last Resolved 04/18/2021 03:16:11 VirusTotal Report cdn-hcp.lumosity.com - - 04/18/2021 03:16:11 Report Domain infuse.sheknows.com Threat Level - Positives - Last Resolved 04/12/2021 18:08:32 VirusTotal Report infuse.sheknows.com - - 04/12/2021 18:08:32 Report Domain staging-widgets-cdn.sheknows.com Threat Level - Positives - Last Resolved 04/12/2021 18:09:12 VirusTotal Report staging-widgets-cdn.sheknows.com - - 04/12/2021 18:09:12 Report Domain stg-connect.sheknows.com Threat Level - Positives - Last Resolved 04/12/2021 18:24:10 VirusTotal Report stg-connect.sheknows.com - - 04/12/2021 18:24:10 Report Domain stg-lookerbot.sheknows.com Threat Level - Positives - Last Resolved 04/12/2021 18:22:18 VirusTotal Report stg-lookerbot.sheknows.com - - 04/12/2021 18:22:18 Report Show SSL	443 TCP	ccleaner.exe PID: 2040 ccleaner.exe PID: 2564	United States
18.233.120.6 OSINT Associated Artifacts for 18.233.120.6 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 8ca972c65f55334145a0ef4b782966a5abe0b709257d200b5875564fa07cb5e9 Threat Level no verdict Positives - Scan Date 04/17/2021 00:15:52 Reference AlienVault 8ca972c65f55334145a0ef4b782966a5abe0b709257d200b5875564fa07cb5e9 no verdict - 04/17/2021 00:15:52 AlienVault Associated SHA256 a028110b7ebce6488a11e14755a6febf96b3ab0b62d9801708fbe943660e09fe Threat Level no verdict Positives - Scan Date 03/03/2021 14:13:15 Reference AlienVault a028110b7ebce6488a11e14755a6febf96b3ab0b62d9801708fbe943660e09fe no verdict - 03/03/2021 14:13:15 AlienVault Associated SHA256 d18eb084c89ba64e808432d716705c59d672a1e1d392b58c367c80b16914af82 Threat Level no verdict Positives - Scan Date 02/28/2021 12:01:24 Reference AlienVault d18eb084c89ba64e808432d716705c59d672a1e1d392b58c367c80b16914af82 no verdict - 02/28/2021 12:01:24 AlienVault Associated SHA256 a797feb766018c962fe955c1d99600ebf87310907752adb9980c47225f7d72df Threat Level no verdict Positives - Scan Date 01/20/2019 08:19:10 Reference AlienVault a797feb766018c962fe955c1d99600ebf87310907752adb9980c47225f7d72df no verdict - 01/20/2019 08:19:10 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain license-apis-production-1499952566.us-east-1.elb.amazonaws.com Threat Level - Positives - Last Resolved 12/28/2020 09:59:39 VirusTotal Report license-apis-production-1499952566.us-east-1.elb.amazonaws.com - - 12/28/2020 09:59:39 Report Domain license-api.ccleaner.com Threat Level - Positives - Last Resolved 12/23/2020 05:30:01 VirusTotal Report license-api.ccleaner.com - - 12/23/2020 05:30:01 Report Domain spotsfor.rocks Threat Level - Positives - Last Resolved 12/10/2020 13:59:49 VirusTotal Report spotsfor.rocks - - 12/10/2020 13:59:49 Report Domain marketingtechworld.com Threat Level - Positives - Last Resolved 11/08/2018 12:17:31 VirusTotal Report marketingtechworld.com - - 11/08/2018 12:17:31 Report Domain v.telemarketingit.com Threat Level - Positives - Last Resolved 11/08/2018 13:55:44 VirusTotal Report v.telemarketingit.com - - 11/08/2018 13:55:44 Report	443 TCP	ccleaner.exe PID: 2040	United States
151.101.2.202 OSINT Associated Artifacts for 151.101.2.202 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://dreamhost.com/ Threat Level suspicious Positives 1/83 Scan Date 01/13/2021 07:08:35 Reference - http://dreamhost.com/ suspicious 1/83 01/13/2021 07:08:35 - Associated URL http://dreamhost.com/add_list.cgi Threat Level suspicious Positives 1/79 Scan Date 09/09/2020 20:21:22 Reference - http://dreamhost.com/add_list.cgi suspicious 1/79 09/09/2020 20:21:22 - Associated URL https://dreamhost.com/blog/how-to-create-linkedin-company-page Threat Level suspicious Positives 1/78 Scan Date 09/01/2020 02:44:04 Reference - https://dreamhost.com/blog/how-to-create-linkedin-company-page suspicious 1/78 09/01/2020 02:44:04 - Associated URL https://www.ozmall.co.jp/wedding/shop/ToHP.aspx?contractID=2371&url=http://inx.lv/Q6NK Threat Level suspicious Positives 1/79 Scan Date 07/20/2020 19:55:12 Reference - https://www.ozmall.co.jp/wedding/shop/ToHP.aspx?contractID=2371&url=http://inx.lv/Q6NK suspicious 1/79 07/20/2020 19:55:12 - Associated URL https://www.kickstarter.com/projects/chaddichor/932679064?ref=34etao&token=3bc20b68 Threat Level suspicious Positives 1/80 Scan Date 05/12/2020 12:02:27 Reference - https://www.kickstarter.com/projects/chaddichor/932679064?ref=34etao&token=3bc20b68 suspicious 1/80 05/12/2020 12:02:27 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 Threat Level no verdict Positives - Scan Date 05/09/2021 08:51:58 Reference AlienVault 914de5a7afd8925b249774af2e2b1248def2e9385792949acd0c0fab2928de98 no verdict - 05/09/2021 08:51:58 AlienVault Associated SHA256 17d7836be3c0424c8657cd8dbe0bdb68916aa0d8871235737c7cf96c3b3e6865 Threat Level no verdict Positives - Scan Date 05/05/2021 15:33:40 Reference AlienVault 17d7836be3c0424c8657cd8dbe0bdb68916aa0d8871235737c7cf96c3b3e6865 no verdict - 05/05/2021 15:33:40 AlienVault Associated SHA256 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 Threat Level no verdict Positives - Scan Date 05/05/2021 15:21:44 Reference AlienVault 3bdf37575885dc84540cd3cecc4d5a2650124f4386e6db86cc89fd8bdbcdecc9 no verdict - 05/05/2021 15:21:44 AlienVault Associated SHA256 b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f Threat Level no verdict Positives - Scan Date 05/02/2021 16:33:56 Reference AlienVault b72d08140b5496a8a16241f9037ad2e5b09c6939dca7414b8e03d91e9bae853f no verdict - 05/02/2021 16:33:56 AlienVault Associated SHA256 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 Threat Level no verdict Positives - Scan Date 04/01/2021 21:16:39 Reference AlienVault 6e305b1e8fe6f139cd582c7ace6f00c25522582de65919041c13619a30a33f40 no verdict - 04/01/2021 21:16:39 AlienVault Associated SHA256 57d6bbc5af70b33d07d67dd217037770addfa508b73b60d1be632fed45e4d4dd Threat Level suspicious Positives 1/75 Scan Date 12/06/2020 15:19:07 Reference VirusTotal 57d6bbc5af70b33d07d67dd217037770addfa508b73b60d1be632fed45e4d4dd suspicious 1/75 12/06/2020 15:19:07 VirusTotal Associated SHA256 f500da5c08ff1f022384f35462c981d52c5de70267618a4508d2607f1a507427 Threat Level suspicious Positives 1/71 Scan Date 07/30/2019 04:28:43 Reference VirusTotal f500da5c08ff1f022384f35462c981d52c5de70267618a4508d2607f1a507427 suspicious 1/71 07/30/2019 04:28:43 VirusTotal Associated SHA256 061d81ad0f436635e00a9ff6fe2e4c244212cea33935648edbf1dc55874fcd35 Threat Level malicious Positives 2/72 Scan Date 06/06/2019 09:51:06 Reference VirusTotal 061d81ad0f436635e00a9ff6fe2e4c244212cea33935648edbf1dc55874fcd35 malicious 2/72 06/06/2019 09:51:06 VirusTotal Associated SHA256 e2f325797fbe214056c3859b346a6a122caa3e191e421477b1b627d0f386bd21 Threat Level malicious Positives 2/66 Scan Date 04/27/2019 08:11:45 Reference VirusTotal e2f325797fbe214056c3859b346a6a122caa3e191e421477b1b627d0f386bd21 malicious 2/66 04/27/2019 08:11:45 VirusTotal Associated SHA256 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 Threat Level suspicious Positives 1/57 Scan Date 01/23/2019 09:26:46 Reference VirusTotal 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 suspicious 1/57 01/23/2019 09:26:46 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain fastly.tubi-staging.video Threat Level - Positives - Last Resolved 03/09/2021 00:20:38 VirusTotal Report fastly.tubi-staging.video - - 03/09/2021 00:20:38 Report Domain fastly.tubi.video Threat Level - Positives - Last Resolved 02/28/2021 03:41:23 VirusTotal Report fastly.tubi.video - - 02/28/2021 03:41:23 Report Domain fastly2.tubi.video Threat Level - Positives - Last Resolved 02/28/2021 03:41:23 VirusTotal Report fastly2.tubi.video - - 02/28/2021 03:41:23 Report Domain cache-static-rakugaki.sqex-edge.jp Threat Level - Positives - Last Resolved 01/28/2021 10:35:04 VirusTotal Report cache-static-rakugaki.sqex-edge.jp - - 01/28/2021 10:35:04 Report Domain api.merpay.ninja Threat Level - Positives - Last Resolved 01/27/2021 13:41:02 VirusTotal Report api.merpay.ninja - - 01/27/2021 13:41:02 Report Show SSL	80 TCP	ccleaner.exe PID: 2040	United States
104.16.242.229 OSINT Associated Artifacts for 104.16.242.229 Details Associated URL Threat Level Positives Scan Date Reference Associated URL https://secure.advancedsystemrepair.com/1663/scp/S34570757-GokYdHosp9Zpsijs Threat Level suspicious Positives 1/85 Scan Date 04/04/2021 23:14:42 Reference - https://secure.advancedsystemrepair.com/1663/scp/S34570757-GokYdHosp9Zpsijs suspicious 1/85 04/04/2021 23:14:42 - Associated URL http://secure.advancedsystemrepair.com/1663/p/265256413-fup3lsautsyjde0cda97 Threat Level suspicious Positives 1/85 Scan Date 03/23/2021 15:54:02 Reference - http://secure.advancedsystemrepair.com/1663/p/265256413-fup3lsautsyjde0cda97 suspicious 1/85 03/23/2021 15:54:02 - Associated URL https://secure.advancedsystemrepair.com/1663/p/265256413-fuP3lsAUTsyJde0CDa97 Threat Level suspicious Positives 1/85 Scan Date 03/22/2021 22:35:12 Reference - https://secure.advancedsystemrepair.com/1663/p/265256413-fuP3lsAUTsyJde0CDa97 suspicious 1/85 03/22/2021 22:35:12 - Associated URL https://secure.advancedsystemrepair.com/1663/p/217360973-MbKsdqezVg8VfCE8qOo7 Threat Level suspicious Positives 1/85 Scan Date 03/12/2021 16:24:57 Reference - https://secure.advancedsystemrepair.com/1663/p/217360973-MbKsdqezVg8VfCE8qOo7 suspicious 1/85 03/12/2021 16:24:57 - Associated URL https://secure.advancedsystemrepair.com/mail/289579576-9F34LQLV Threat Level suspicious Positives 1/84 Scan Date 03/09/2021 14:55:04 Reference - https://secure.advancedsystemrepair.com/mail/289579576-9F34LQLV suspicious 1/84 03/09/2021 14:55:04 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c Threat Level malicious Positives 11/74 Scan Date 05/12/2021 21:15:52 Reference VirusTotal 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c malicious 11/74 05/12/2021 21:15:52 VirusTotal Associated SHA256 3e4e2aa7273428e07a4a322d8c00833554e465035ea963e43df8e6e52a9c576a Threat Level malicious Positives 8/74 Scan Date 04/25/2021 08:39:25 Reference VirusTotal 3e4e2aa7273428e07a4a322d8c00833554e465035ea963e43df8e6e52a9c576a malicious 8/74 04/25/2021 08:39:25 VirusTotal Associated SHA256 ce820f52d9c8206cd5ca69c6040cf05ef94d9fda4cf01eb272e5459906bcf97b Threat Level suspicious Positives 1/74 Scan Date 04/23/2021 05:32:35 Reference VirusTotal ce820f52d9c8206cd5ca69c6040cf05ef94d9fda4cf01eb272e5459906bcf97b suspicious 1/74 04/23/2021 05:32:35 VirusTotal Associated SHA256 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a Threat Level malicious Positives 6/75 Scan Date 03/26/2021 01:44:47 Reference VirusTotal 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a malicious 6/75 03/26/2021 01:44:47 VirusTotal Associated SHA256 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc Threat Level malicious Positives 6/75 Scan Date 03/24/2021 00:19:50 Reference VirusTotal 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc malicious 6/75 03/24/2021 00:19:50 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain testcart.ipswitch.com Threat Level - Positives - Last Resolved 05/08/2021 10:28:42 VirusTotal Report testcart.ipswitch.com - - 05/08/2021 10:28:42 Report Domain ursoftware.cleverbridge.com Threat Level - Positives - Last Resolved 04/29/2021 02:56:04 VirusTotal Report ursoftware.cleverbridge.com - - 04/29/2021 02:56:04 Report Domain xml.cleverbridge.com Threat Level - Positives - Last Resolved 04/23/2021 06:52:23 VirusTotal Report xml.cleverbridge.com - - 04/23/2021 06:52:23 Report Domain store.zipshare.com Threat Level - Positives - Last Resolved 04/07/2021 16:08:11 VirusTotal Report store.zipshare.com - - 04/07/2021 16:08:11 Report Domain sharepoint.cleverbridge.com Threat Level - Positives - Last Resolved 03/26/2021 17:39:43 VirusTotal Report sharepoint.cleverbridge.com - - 03/26/2021 17:39:43 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
104.16.243.229 OSINT Associated Artifacts for 104.16.243.229 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://secure.advancedsystemrepair.com/1663/scp/s34570757-gokydhosp9zpsijs Threat Level suspicious Positives 1/85 Scan Date 04/05/2021 15:17:59 Reference - http://secure.advancedsystemrepair.com/1663/scp/s34570757-gokydhosp9zpsijs suspicious 1/85 04/05/2021 15:17:59 - Associated URL https://secure.advancedsystemrepair.com/1663/paypal/252176428-Ywls0zjhhdLNTC0S224C Threat Level suspicious Positives 1/85 Scan Date 04/04/2021 23:14:42 Reference - https://secure.advancedsystemrepair.com/1663/paypal/252176428-Ywls0zjhhdLNTC0S224C suspicious 1/85 04/04/2021 23:14:42 - Associated URL http://secure.advancedsystemrepair.com/1663/p/217360973-mbksdqezvg8vfce8qoo7 Threat Level suspicious Positives 1/85 Scan Date 03/13/2021 16:26:51 Reference - http://secure.advancedsystemrepair.com/1663/p/217360973-mbksdqezvg8vfce8qoo7 suspicious 1/85 03/13/2021 16:26:51 - Associated URL https://secure.advancedsystemrepair.com/mail/289374184-v6Qpb26W Threat Level suspicious Positives 1/85 Scan Date 03/13/2021 09:29:53 Reference - https://secure.advancedsystemrepair.com/mail/289374184-v6Qpb26W suspicious 1/85 03/13/2021 09:29:53 - Associated URL https://secure.advancedsystemrepair.com/mail/291916320-L4nsjgXi Threat Level suspicious Positives 1/85 Scan Date 03/13/2021 07:29:44 Reference - https://secure.advancedsystemrepair.com/mail/291916320-L4nsjgXi suspicious 1/85 03/13/2021 07:29:44 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c Threat Level malicious Positives 10/74 Scan Date 05/03/2021 19:14:18 Reference VirusTotal 818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c malicious 10/74 05/03/2021 19:14:18 VirusTotal Associated SHA256 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a Threat Level malicious Positives 6/75 Scan Date 03/26/2021 01:44:47 Reference VirusTotal 50e5e5ecda4467b0af8b1f5597af8e1b2121489db633ea081f1a94a5483e949a malicious 6/75 03/26/2021 01:44:47 VirusTotal Associated SHA256 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc Threat Level malicious Positives 6/75 Scan Date 03/24/2021 00:19:50 Reference VirusTotal 6976b3806b481b87e33afa93b4fc91c3a6a39f87ad48d25f48cd0dbe2bc2e0cc malicious 6/75 03/24/2021 00:19:50 VirusTotal Associated SHA256 b4f16571e1af4473812ddee32939f3e9aa745a4513b2f5bbfe68f22165c77591 Threat Level suspicious Positives 1/75 Scan Date 02/24/2021 12:23:25 Reference VirusTotal b4f16571e1af4473812ddee32939f3e9aa745a4513b2f5bbfe68f22165c77591 suspicious 1/75 02/24/2021 12:23:25 VirusTotal Associated SHA256 ad96e2d1058ffc92548c560be63d139291c128d06f30d44791e396131fe35896 Threat Level malicious Positives 3/75 Scan Date 02/11/2021 11:22:42 Reference VirusTotal ad96e2d1058ffc92548c560be63d139291c128d06f30d44791e396131fe35896 malicious 3/75 02/11/2021 11:22:42 VirusTotal Associated SHA256 7cc17be7358cf0be8743f08b4569305c456635eba3414e06fd116f356da425d4 Threat Level no verdict Positives - Scan Date 12/03/2020 23:21:49 Reference AlienVault 7cc17be7358cf0be8743f08b4569305c456635eba3414e06fd116f356da425d4 no verdict - 12/03/2020 23:21:49 AlienVault Associated SHA256 590dd73359d0345e8462120cfd0314c7526b81a2232effa5fa9abe91e7e5dc3e Threat Level no verdict Positives - Scan Date 11/30/2020 15:47:26 Reference AlienVault 590dd73359d0345e8462120cfd0314c7526b81a2232effa5fa9abe91e7e5dc3e no verdict - 11/30/2020 15:47:26 AlienVault Associated SHA256 3fdbad5ebe4756ef14fd21cabb4792904bb25baa7cb64f8a5c9b0bcecc6ae199 Threat Level no verdict Positives - Scan Date 11/24/2020 19:32:28 Reference AlienVault 3fdbad5ebe4756ef14fd21cabb4792904bb25baa7cb64f8a5c9b0bcecc6ae199 no verdict - 11/24/2020 19:32:28 AlienVault Associated SHA256 511c94d56c0bde9e0847894640cb3d71802f56f02e954515e5d1780eba03b277 Threat Level no verdict Positives - Scan Date 08/29/2020 09:18:49 Reference AlienVault 511c94d56c0bde9e0847894640cb3d71802f56f02e954515e5d1780eba03b277 no verdict - 08/29/2020 09:18:49 AlienVault Associated SHA256 93418983608109ee85d8b74b9d57018953015cb254576671dfba2108784f191c Threat Level no verdict Positives - Scan Date 12/05/2019 06:53:54 Reference AlienVault 93418983608109ee85d8b74b9d57018953015cb254576671dfba2108784f191c no verdict - 12/05/2019 06:53:54 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain testcart.ipswitch.com Threat Level - Positives - Last Resolved 05/08/2021 10:28:42 VirusTotal Report testcart.ipswitch.com - - 05/08/2021 10:28:42 Report Domain ursoftware.cleverbridge.com Threat Level - Positives - Last Resolved 04/29/2021 02:56:04 VirusTotal Report ursoftware.cleverbridge.com - - 04/29/2021 02:56:04 Report Domain xml.cleverbridge.com Threat Level - Positives - Last Resolved 04/23/2021 06:52:23 VirusTotal Report xml.cleverbridge.com - - 04/23/2021 06:52:23 Report Domain store.zipshare.com Threat Level - Positives - Last Resolved 04/07/2021 16:08:11 VirusTotal Report store.zipshare.com - - 04/07/2021 16:08:11 Report Domain sharepoint.cleverbridge.com Threat Level - Positives - Last Resolved 03/26/2021 17:39:43 VirusTotal Report sharepoint.cleverbridge.com - - 03/26/2021 17:39:43 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
34.96.102.137 OSINT Associated Artifacts for 34.96.102.137 Details Associated URL Threat Level Positives Scan Date Reference Associated URL https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=https://oldschool-runescapemobile.com/promotions.html&r=0.30524084585629785 Threat Level suspicious Positives 1/79 Scan Date 07/03/2020 10:30:09 Reference - https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=https://oldschool-runescapemobile.com/promotions.html&r=0.30524084585629785 suspicious 1/79 07/03/2020 10:30:09 - Associated URL https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=https://oldschool-runescapemobile.com/promotions&r=0.7732935383564157 Threat Level suspicious Positives 1/79 Scan Date 07/02/2020 22:48:42 Reference - https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=https://oldschool-runescapemobile.com/promotions&r=0.7732935383564157 suspicious 1/79 07/02/2020 22:48:42 - Associated URL https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=http://jagex-mobile.com/promo&r=0.24295613671810035 Threat Level suspicious Positives 1/79 Scan Date 07/02/2020 14:27:39 Reference - https://dev.visualwebsiteoptimizer.com/j.php?a=54596&u=http://jagex-mobile.com/promo&r=0.24295613671810035 suspicious 1/79 07/02/2020 14:27:39 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 cb128d8aabe7b315f546d280017ff21e22328f0be39c8dd0e10132eb89236b5e Threat Level no verdict Positives - Scan Date 04/30/2021 20:25:12 Reference AlienVault cb128d8aabe7b315f546d280017ff21e22328f0be39c8dd0e10132eb89236b5e no verdict - 04/30/2021 20:25:12 AlienVault Associated SHA256 7e8324b741cfe022944a9dd089bacf8b891fff335025e05e48d7b9633c6e76f7 Threat Level no verdict Positives - Scan Date 04/22/2021 14:12:15 Reference AlienVault 7e8324b741cfe022944a9dd089bacf8b891fff335025e05e48d7b9633c6e76f7 no verdict - 04/22/2021 14:12:15 AlienVault Associated SHA256 3d774179fdb0f80687b11720c4fc5852b7a9b7e7a075fa6387efb1bff038b94e Threat Level no verdict Positives - Scan Date 04/13/2021 14:04:02 Reference AlienVault 3d774179fdb0f80687b11720c4fc5852b7a9b7e7a075fa6387efb1bff038b94e no verdict - 04/13/2021 14:04:02 AlienVault Associated SHA256 48c2271f31c0608294950b568a7df752926a3d6d7e9ae1c31abfb938d08360b1 Threat Level no verdict Positives - Scan Date 04/09/2021 10:35:49 Reference AlienVault 48c2271f31c0608294950b568a7df752926a3d6d7e9ae1c31abfb938d08360b1 no verdict - 04/09/2021 10:35:49 AlienVault Associated SHA256 03441329e2ef9ba5001830de24e9fb8a8f09de303d83847c7b689f3c9172cc45 Threat Level no verdict Positives - Scan Date 04/06/2021 13:08:30 Reference AlienVault 03441329e2ef9ba5001830de24e9fb8a8f09de303d83847c7b689f3c9172cc45 no verdict - 04/06/2021 13:08:30 AlienVault Associated SHA256 512ac1ace2528508b9fd9c461c699875828fb71b706a5c3f1452d290c555135e Threat Level suspicious Positives 1/76 Scan Date 11/05/2020 12:25:31 Reference VirusTotal 512ac1ace2528508b9fd9c461c699875828fb71b706a5c3f1452d290c555135e suspicious 1/76 11/05/2020 12:25:31 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain dacdn.navilytics.com Threat Level - Positives - Last Resolved 05/14/2020 12:59:57 VirusTotal Report dacdn.navilytics.com - - 05/14/2020 12:59:57 Report Domain 137.102.96.34.bc.googleusercontent.com Threat Level - Positives - Last Resolved 03/04/2020 18:23:33 VirusTotal Report 137.102.96.34.bc.googleusercontent.com - - 03/04/2020 18:23:33 Report Domain dacdn.visualwebsiteoptimizer.com Threat Level - Positives - Last Resolved 02/17/2020 14:21:18 VirusTotal Report dacdn.visualwebsiteoptimizer.com - - 02/17/2020 14:21:18 Report Domain dev.visualwebsiteoptimizer.com Threat Level - Positives - Last Resolved 02/14/2020 18:12:36 VirusTotal Report dev.visualwebsiteoptimizer.com - - 02/14/2020 18:12:36 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
54.201.108.228 OSINT Associated Artifacts for 54.201.108.228 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 ffba692fbaaadf88bcc7fb2213bccf44952089c7020b220cd2892a4c2d72da5f Threat Level no verdict Positives - Scan Date 05/07/2021 22:38:16 Reference AlienVault ffba692fbaaadf88bcc7fb2213bccf44952089c7020b220cd2892a4c2d72da5f no verdict - 05/07/2021 22:38:16 AlienVault Associated SHA256 7bfac70dab35b4523742a55be1ee534ad1159d659549ec7919e140b6abe19a60 Threat Level no verdict Positives - Scan Date 04/19/2021 12:11:05 Reference AlienVault 7bfac70dab35b4523742a55be1ee534ad1159d659549ec7919e140b6abe19a60 no verdict - 04/19/2021 12:11:05 AlienVault Associated SHA256 0214195163ea793aad4a8068dd592c0e795ebd54f92e86439c6c7237f0743d34 Threat Level no verdict Positives - Scan Date 12/23/2020 12:54:22 Reference AlienVault 0214195163ea793aad4a8068dd592c0e795ebd54f92e86439c6c7237f0743d34 no verdict - 12/23/2020 12:54:22 AlienVault Associated SHA256 58c7599211da3416bb0b4d01e59f29741e327247ea18d725254a19addcc8ad24 Threat Level no verdict Positives - Scan Date 12/23/2020 12:52:07 Reference AlienVault 58c7599211da3416bb0b4d01e59f29741e327247ea18d725254a19addcc8ad24 no verdict - 12/23/2020 12:52:07 AlienVault Associated SHA256 7adeaa80ba76aa194d67984d7869cca1e557f9266b392a81aa56326124ca0efc Threat Level no verdict Positives - Scan Date 07/05/2020 13:26:37 Reference AlienVault 7adeaa80ba76aa194d67984d7869cca1e557f9266b392a81aa56326124ca0efc no verdict - 07/05/2020 13:26:37 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain ec2-54-201-108-228.us-west-2.compute.amazonaws.com Threat Level - Positives - Last Resolved 04/16/2020 02:10:01 VirusTotal Report ec2-54-201-108-228.us-west-2.compute.amazonaws.com - - 04/16/2020 02:10:01 Report Domain seal.digicert.com Threat Level - Positives - Last Resolved 07/30/2019 17:38:59 VirusTotal Report seal.digicert.com - - 07/30/2019 17:38:59 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
216.58.194.163 OSINT Associated Artifacts for 216.58.194.163 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://216.58.194.163/ Threat Level suspicious Positives 1/84 Scan Date 03/10/2021 11:21:30 Reference - http://216.58.194.163/ suspicious 1/84 03/10/2021 11:21:30 - Associated URL https://216.58.194.163/ Threat Level suspicious Positives 1/80 Scan Date 10/24/2020 06:00:14 Reference - https://216.58.194.163/ suspicious 1/80 10/24/2020 06:00:14 - Associated URL https://beacons2.gvt2.com/ Threat Level suspicious Positives 1/72 Scan Date 02/18/2020 05:55:09 Reference - https://beacons2.gvt2.com/ suspicious 1/72 02/18/2020 05:55:09 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 f7ea7f38f9fa732acfcf3957c4e6534fd3fac20a2c5383578033ceb118322acf Threat Level no verdict Positives - Scan Date 10/15/2019 03:36:26 Reference AlienVault f7ea7f38f9fa732acfcf3957c4e6534fd3fac20a2c5383578033ceb118322acf no verdict - 10/15/2019 03:36:26 AlienVault Associated SHA256 87da5094cafb690fdcef58c7427bb63a0c373ea13c3d37097cadc63492035431 Threat Level no verdict Positives - Scan Date 10/08/2019 15:22:38 Reference AlienVault 87da5094cafb690fdcef58c7427bb63a0c373ea13c3d37097cadc63492035431 no verdict - 10/08/2019 15:22:38 AlienVault Associated SHA256 0b2ddc5f204ca21d624e48903c9fcd108624efb7d28156d0ba8457a4ade034b7 Threat Level no verdict Positives - Scan Date 10/08/2019 15:02:01 Reference AlienVault 0b2ddc5f204ca21d624e48903c9fcd108624efb7d28156d0ba8457a4ade034b7 no verdict - 10/08/2019 15:02:01 AlienVault Associated SHA256 ff4b536fb6f4f48468a02f137daf4d5928d489fc21253832e84cfb91ff95c777 Threat Level no verdict Positives - Scan Date 09/05/2019 00:46:56 Reference AlienVault ff4b536fb6f4f48468a02f137daf4d5928d489fc21253832e84cfb91ff95c777 no verdict - 09/05/2019 00:46:56 AlienVault Associated SHA256 a051667931872261e70fefa97cad97334c5782b7a6327a7e43a72d3f950aafb3 Threat Level no verdict Positives - Scan Date 09/04/2019 23:30:21 Reference AlienVault a051667931872261e70fefa97cad97334c5782b7a6327a7e43a72d3f950aafb3 no verdict - 09/04/2019 23:30:21 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain id.google.cm Threat Level - Positives - Last Resolved 05/08/2021 13:32:15 VirusTotal Report id.google.cm - - 05/08/2021 13:32:15 Report Domain mustafaalmosawi.net Threat Level - Positives - Last Resolved 04/07/2021 14:31:43 VirusTotal Report mustafaalmosawi.net - - 04/07/2021 14:31:43 Report Domain id.google.com.my Threat Level - Positives - Last Resolved 03/16/2021 04:29:32 VirusTotal Report id.google.com.my - - 03/16/2021 04:29:32 Report Domain id.google.com.tr Threat Level - Positives - Last Resolved 03/16/2021 13:54:29 VirusTotal Report id.google.com.tr - - 03/16/2021 13:54:29 Report Domain id.google.com.sa Threat Level - Positives - Last Resolved 12/30/2020 05:38:13 VirusTotal Report id.google.com.sa - - 12/30/2020 05:38:13 Report	80 TCP	ccleaner.exe PID: 2040	United States
192.124.249.24 OSINT Associated Artifacts for 192.124.249.24 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQCpnqODomqskQ== Threat Level suspicious Positives 1/83 Scan Date 01/23/2021 14:21:48 Reference - http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQCpnqODomqskQ== suspicious 1/83 01/23/2021 14:21:48 - Associated URL http://ocsp.starfieldtech.com/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCHl8pct5tVo7 Threat Level suspicious Positives 1/83 Scan Date 01/05/2021 23:47:36 Reference - http://ocsp.starfieldtech.com/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCHl8pct5tVo7 suspicious 1/83 01/05/2021 23:47:36 - Associated URL http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQCN6bxKucM1jQ== Threat Level suspicious Positives 1/83 Scan Date 12/17/2020 04:24:26 Reference - http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQCN6bxKucM1jQ== suspicious 1/83 12/17/2020 04:24:26 - Associated URL http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQDe/AZppOLu8Q== Threat Level suspicious Positives 1/82 Scan Date 12/07/2020 03:55:26 Reference - http://ocsp.starfieldtech.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM+uArAQUJUWBaFAmOD07LSy+zWrZtj2zZmMCCQDe/AZppOLu8Q== suspicious 1/82 12/07/2020 03:55:26 - Associated URL http://ocsp.starfieldtech.com/MEgwRjBEMEIwQDAJBgUrDgMCGgUABBSTwrUmjBrz0iqZG2KyfsAEC3N2DgQUSUtSJ9EbvPKhIWpie1FCeorX1VYCBwRSmYe/bxI= Threat Level suspicious Positives 1/82 Scan Date 11/24/2020 12:06:31 Reference - http://ocsp.starfieldtech.com/MEgwRjBEMEIwQDAJBgUrDgMCGgUABBSTwrUmjBrz0iqZG2KyfsAEC3N2DgQUSUtSJ9EbvPKhIWpie1FCeorX1VYCBwRSmYe/bxI= suspicious 1/82 11/24/2020 12:06:31 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 1fc34b381c0b7289af2654cf4e4f96b2883fa30c9a46d69761c3b38a80fc1981 Threat Level no verdict Positives - Scan Date 05/14/2021 12:20:58 Reference AlienVault 1fc34b381c0b7289af2654cf4e4f96b2883fa30c9a46d69761c3b38a80fc1981 no verdict - 05/14/2021 12:20:58 AlienVault Associated SHA256 36d27911ab36ab5edeaf88341f22842ea08e41e36135976cf71df6130089f299 Threat Level no verdict Positives - Scan Date 05/14/2021 09:46:33 Reference AlienVault 36d27911ab36ab5edeaf88341f22842ea08e41e36135976cf71df6130089f299 no verdict - 05/14/2021 09:46:33 AlienVault Associated SHA256 24a2158ea5822800c462450dbf9a91637fd139ff23f67574fa586e2087d88c90 Threat Level no verdict Positives - Scan Date 05/11/2021 19:08:46 Reference AlienVault 24a2158ea5822800c462450dbf9a91637fd139ff23f67574fa586e2087d88c90 no verdict - 05/11/2021 19:08:46 AlienVault Associated SHA256 ed3a4f43e47061467b0d32d0cf33dbca832d148ccd9da1e0a196f147d10d90e3 Threat Level no verdict Positives - Scan Date 05/09/2021 00:03:24 Reference AlienVault ed3a4f43e47061467b0d32d0cf33dbca832d148ccd9da1e0a196f147d10d90e3 no verdict - 05/09/2021 00:03:24 AlienVault Associated SHA256 f118f84309003a3b49106ff5ded5bc59653f39b0ff8236f28f244dfa3fc87928 Threat Level no verdict Positives - Scan Date 05/08/2021 15:59:46 Reference AlienVault f118f84309003a3b49106ff5ded5bc59653f39b0ff8236f28f244dfa3fc87928 no verdict - 05/08/2021 15:59:46 AlienVault Details Domain Threat Level Positives Last Resolved Reference Domain ocsp.starfieldtech.com Threat Level - Positives - Last Resolved 11/04/2019 11:59:19 VirusTotal Report ocsp.starfieldtech.com - - 11/04/2019 11:59:19 Report Domain ocsp.godaddy.com Threat Level - Positives - Last Resolved 09/26/2019 00:17:28 VirusTotal Report ocsp.godaddy.com - - 09/26/2019 00:17:28 Report Domain ocsp.godaddy.com.akadns.net Threat Level - Positives - Last Resolved 09/23/2019 05:10:28 VirusTotal Report ocsp.godaddy.com.akadns.net - - 09/23/2019 05:10:28 Report Domain cloudproxy10024.sucuri.net Threat Level - Positives - Last Resolved 09/14/2019 16:09:22 VirusTotal Report cloudproxy10024.sucuri.net - - 09/14/2019 16:09:22 Report	80 TCP	ccleaner.exe PID: 2040	United States
142.250.141.157 OSINT Associated Artifacts for 142.250.141.157 Details Domain Threat Level Positives Last Resolved Reference Domain ads-bid.l.doubleclick.net Threat Level - Positives - Last Resolved 05/06/2021 10:10:34 VirusTotal Report ads-bid.l.doubleclick.net - - 05/06/2021 10:10:34 Report Domain bid.g.doubleclick.net Threat Level - Positives - Last Resolved 05/06/2021 10:12:35 VirusTotal Report bid.g.doubleclick.net - - 05/06/2021 10:12:35 Report Domain stats.g.doubleclick.net Threat Level - Positives - Last Resolved 04/26/2021 05:03:21 VirusTotal Report stats.g.doubleclick.net - - 04/26/2021 05:03:21 Report Domain stats.l.doubleclick.net Threat Level - Positives - Last Resolved 04/26/2021 11:39:25 VirusTotal Report stats.l.doubleclick.net - - 04/26/2021 11:39:25 Report Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
172.217.5.100 Show SSL	443 TCP	ccleaner.exe PID: 2040	United States
3.211.255.95	443 TCP	ccleaner.exe PID: 2564	United States
5.62.45.38 Show SSL	443 TCP	ccleaner.exe PID: 2564	United Kingdom
5.62.48.18 Show SSL	443 TCP	ccupdate.exe PID: 2644	United Kingdom
23.62.230.100	80 TCP	ccleaner.exe PID: 1340	United States
23.62.230.104	80 TCP	ccleaner.exe PID: 3740	United States