Edit tour

Windows Analysis Report
ccsetup624.exe

Overview

General Information

Sample name:	ccsetup624.exe
Analysis ID:	1456709
MD5:	298fad6ade1e160d2d1044b168ba1142
SHA1:	4cb421246924006ca9f53496d0a8408e1fb84326
SHA256:	131863f0cd71b30055800f68c951b5d7744fa6443ffbc4004a24ba3e0577800e
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	50
Range:	0 - 100

Signatures

Yara detected AntiVM3

Contains functionality to infect the boot sector

Disables Windows system restore

Query firmware table information (likely to detect VMs)

Reads the Security eventlog

Reads the System eventlog

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

ccsetup624.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\ccsetup624.exe" MD5: 298FAD6ADE1E160D2D1044B168BA1142)

CCleaner64.exe (PID: 5800 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC MD5: 64F2F2700C072BDE21A02E45D0A05C68)

CCUpdate.exe (PID: 5224 cmdline: "C:\Program Files\CCleaner\CCUpdate.exe" /reg MD5: 0F0B90A01F049665CA511335F9F0BF2E)

CCUpdate.exe (PID: 7060 cmdline: CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll" MD5: 0F0B90A01F049665CA511335F9F0BF2E)

chrome.exe (PID: 6888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

CCleaner64.exe (PID: 4108 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" MD5: 64F2F2700C072BDE21A02E45D0A05C68)

wa_3rd_party_host_32.exe (PID: 8180 cmdline: --pid=4108 MD5: DFE443F3ABEF2CE3B2FE1D3C309CE50A)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CCUpdate.exe (PID: 6888 cmdline: "C:\Program Files\CCleaner\CCUpdate.exe" MD5: 0F0B90A01F049665CA511335F9F0BF2E)

chrome.exe (PID: 5244 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1904,i,2080959678102161561,3568569212771411705,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

CCleanerBugReport.exe (PID: 6436 cmdline: "C:\Program Files\CCleaner\CCleanerBugReport.exe" --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --guid "cbec92ce-75e2-490f-bc67-2e710fa383e0" --version "6.24.11060" --silent MD5: 30F22B80E4FA1BEA515CE41175E94DE8)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CCleaner.exe (PID: 4480 cmdline: "C:\Program Files\CCleaner\CCleaner.exe" 0 MD5: AB264CBE086494E6E4F57E1975F032EC)

CCleaner64.exe (PID: 6472 cmdline: "C:\Program Files\CCleaner\CCleaner.exe" 0 MD5: 64F2F2700C072BDE21A02E45D0A05C68)

CCleaner64.exe (PID: 3868 cmdline: "C:\Program Files\CCleaner\CCleaner64.exe" /monitor MD5: 64F2F2700C072BDE21A02E45D0A05C68)

wa_3rd_party_host_32.exe (PID: 6216 cmdline: --pid=6472 MD5: DFE443F3ABEF2CE3B2FE1D3C309CE50A)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 4828 cmdline: C:\Windows\system32\WerFault.exe -u -p 6472 -s 8068 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 6568 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1880 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

CCleanerPerformanceOptimizerService.exe (PID: 2488 cmdline: "C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe" MD5: 21F845A804361181A6D9C49C8055F4D7)

unsecapp.exe (PID: 8036 cmdline: C:\Windows\system32\wbem\unsecapp.exe -Embedding MD5: 9B782B1E1D7A2C28302755F963EAC907)

svchost.exe (PID: 8156 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 2324 cmdline: C:\Windows\system32\WerFault.exe -pss -s 436 -p 6472 -ip 6472 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 2656 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000012.00000003.2384834604.00000194E4DD4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000003.2383185325.00000194ED024000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000003.2384556930.00000194ED2FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000003.2383510265.00000194ED14B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000003.2382716752.00000194EC6FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR, EventID: 13, EventType: SetValue, Image: C:\Program Files\CCleaner\CCleaner64.exe, ProcessId: 3868, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CCleaner Smart Cleaning

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe, ProcessId: 8180, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4faoa0er.2da.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6568, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6a51964b-d

Compliance

Uses 32bit PE files

Source: ccsetup624.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaheap.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwalocal.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaresource.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwautils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\uninst.exe	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Setup\config.def	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\cd5ed1e5-b9ec-43a5-92fa-721007ae7216.ini	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\5f657c67-a31a-41b8-a111-f1acbb9f600c.xml	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Directory created: C:\Program Files\CCleaner\log\BugReport.log.tmp.ba3d061e-a5d6-48dc-8ffe-ac0babbb6a3d	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Directory created: C:\Program Files\CCleaner\log\BugReport.status	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log.tmp.d774a070-945b-4037-99c1-7f7214253f48
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEng.log.tmp.c72224d4-4032-4506-8529-a0862ddbd6ea
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log.tmp.edb72a92-e2b2-47b3-a474-edfb542af7f1
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\journal
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\log
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\report
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\chest
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\moved
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\fw
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\event_manager.log.tmp.700487c0-14db-4a4a-bbd5-a4a14a007439
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\usercfg.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\BackupStorage
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\20c26c95-aefa-4c4a-a131-fdebc087b51e
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-08-468.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-17-091.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-26-405.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-36-438.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\state_cache.json.{1BC2E4AC-BDC0-4BFF-A0E6-C73932CE4EC9}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\e4e02ba7-b8e3-4656-b16c-1c6154bda034
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_controller.log.tmp.9fbf1b57-2a09-404d-ab05-ecfadef76b79
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_telemetry.log.tmp.a2504234-4a25-463a-bff1-dda1306bfdd2
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a913d86d-d3f4-4e76-a21e-e0a66af3739d
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_adapter.log.tmp.13b91b14-6577-40bd-98f0-f47b43ce0131
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\DUState.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-07-948.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\InitialDUState V23_4.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-18-898.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-28-680.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-38-103.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\state_cache.json.{32F5E59D-14FB-44CA-856F-43B0FFE9EDB5}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\8d965214-8ffd-49d5-bf57-6d07f021c978
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\unp311126142200928707i-unhandled.mdmp
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Directory created: C:\Program Files\CCleaner\LOG\pd.log.tmp.72028699-14f0-4c06-a2c4-18e38d276c7d

Creates a software uninstall entry

Source: C:\Users\user\Desktop\ccsetup624.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner

Jump to behavior

PE / OLE file has a valid certificate

Source: ccsetup624.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.209.22:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50498 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: ccsetup624.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: gcapi_dll.dll.pdb\| source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\_av\BUILDS\Release\x86\emupdate.pdb source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x64\CCleaner64.pdb source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x86\CCleaner.pdb# source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\AvastClient\BUILDS\Release\x64\CCleanerBugReport.pdb source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: gcapi_dll.dll.pdb source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: gcapi_dll.dll.pdbpf source: CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\BUILD\work\67d9289f94964a81\BUILDS\Release\x86\CCUpdate.pdb source: CCUpdate.exe, 00000007.00000002.2198509554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000007.00000000.2110048253.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000002.2126716554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000000.2124099830.00000000002A3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x86\CCleaner.pdb source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002500EB __EH_prolog3_GS,FindFirstFileW,_wcsrchr,GetFileAttributesW,FindNextFileW,FindClose,	7_2_002500EB
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00293665 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00293665
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0023ECE0 __EH_prolog3_GS,FindFirstFileW,SetFileAttributesW,DeleteFileW,GetLastError,Sleep,FindNextFileW,SetFileAttributesW,RemoveDirectoryW,GetLastError,FindClose,	7_2_0023ECE0

Networking

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 62

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 34.149.149.62 34.149.149.62
Source: Joe Sandbox View	IP Address: 104.18.32.137 104.18.32.137
Source: Joe Sandbox View	IP Address: 70.42.32.127 70.42.32.127

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ch7buv2b6zszht8&MD=GG3Kzpk1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?p_elm=76&action=1&p_age=0&p_bau=0&p_bsls=0&p_chcc=2&p_chr=0&p_dvt=3&p_fds=172544&p_gis=0&p_hid=7405db15-874d-4e6f-8241-ed46b708c09c&p_lid=en-CH&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF3F882106AB5231C40D5B3E7F3FACDCDE&p_osv=10.0&p_pro=90&p_sbi=0&p_scbu=0&p_tos=0&p_vbd=11060&p_vep=6&p_ves=24&p_wid=1657237750 HTTP/1.1Connection: Keep-AliveUser-Agent: Avast AntivirusHost: ipm-provider.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /?p_vep=6&p_ves=24&p_vbd=11060&p_lit=0&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF3F882106AB5231C40D5B3E7F3FACDCDE&p_hid=cbec92ce-75e2-490f-bc67-2e710fa383e0&p_pro=90&p_osv=10.0&p_gksw=0&p_lng=en&p_lid=en-us HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.24.11060)Host: shepherd.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /v2/info HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: CCleaner Update AgentHost: ip-info.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /v2/info HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: CCleaner Update AgentHost: ip-info.ff.avast.com
Source: global traffic	HTTP traffic detected: GET /v1/info HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.24.11060)Host: ip-info.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ch7buv2b6zszht8&MD=GG3Kzpk1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?action=1&p_elm=229&p_lng=en&p_lid=en-us&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF3F882106AB5231C40D5B3E7F3FACDCDE&p_hid=cbec92ce-75e2-490f-bc67-2e710fa383e0&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_a8f_m&p_dols=0&p_sols=0&p_pts=0&p_ftc=0&p_btc=0&p_pro=90&p_vep=6&p_ves=24&p_vbd=11060&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_ccgd=0&p_ccod=0&p_ccdb=0&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240613 HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.24.11060)Host: ipm-provider.ff.avast.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/OtAutoBlock.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?action=1&p_elm=0&p_lng=en&p_lid=en-us&p_geo=US&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF3F882106AB5231C40D5B3E7F3FACDCDE&p_hid=cbec92ce-75e2-490f-bc67-2e710fa383e0&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_a8f_m&p_dols=0&p_sols=0&p_pts=0&p_ftc=0&p_btc=0&p_pro=90&p_vep=6&p_ves=24&p_vbd=11060&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_ccgd=0&p_ccod=0&p_ccdb=0&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240613 HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.24.11060)Host: ipm-provider.ff.avast.comCache-Control: no-cacheCookie: ClientId=2e23bfc1-5968-4062-bf73-90a867e8cbb7
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/831b8ee0-e952-49a5-af6b-01382c722774.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?onload=ccleaner_recaptcha_onloadCallback&render=explicit HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1Host: widget.trustpilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1718292476329 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/ytc.js HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-857043.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/mhubc.js HTTP/1.1Host: mstatic.ccleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19888%7CvVersion%7C5.5.0; avstperm=C0001%3A0%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0%2CC0005%3A0; sourceCodeCookie=999_a8f\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; __trSrc=999_a8f; sdl_cid=1985814156.1718292476; _gcl_au=1.1.353929047.1718292477; __srcCookie=007_z8f\|\|source=(Other)\|medium=(none)\|campaign=(not set)\|segmentCode=z; pglpid=undefined
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: symantec.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=17054165488447196061006843670070479181
Source: global traffic	HTTP traffic detected: GET /tags/563151391133/tag.js HTTP/1.1Host: www.mczbf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=116171568.1718292477&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060&dma=0&npa=0&gtm=45He46c0n71KFXRTRv71945860za200&auid=353929047.1718292477 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.db8890ba82a7e392473f.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wi/config/10180940.json HTTP/1.1Host: s.yimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1718292476329 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=17054165488447196061006843670070479181
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s13604510390727?AQB=1&ndh=1&pf=1&t=13%2F5%2F2024%2011%3A27%3A57%204%20240&mid=17208700609507986630986886010044630524&aamlh=6&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-04-17&c48=CCleaner%20v6.24.11060&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=17208700609507986630986886010044630524&c59=ccleaner%3Aknowledge%3Accleaner-v6-24-11060&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060&v164=ccleaner%3A999_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1034&bh=870&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.ccleaner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: avstperm=C0001%3A0%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0%2CC0005%3A0; sourceCodeCookie=999_a8f\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; __trSrc=999_a8f; sdl_cid=1985814156.1718292476; _gcl_au=1.1.353929047.1718292477; __srcCookie=007_z8f\|\|source=(Other)\|medium=(none)\|campaign=(not set)\|segmentCode=z; pglpid=undefined; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19888%7CMCMID%7C17208700609507986630986886010044630524%7CMCAAMLH-1718897277%7C6%7CMCAAMB-1718897277%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1718299677s%7CNONE%7CvVersion%7C5.5.0; s_nr=1718292477985-New; event69=event69; channelStack=s_eVar72~ccleaner; s_tbm=true; s_gpv=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060; s_gpv_custom=ccleaner%3Aknowledge%3Accleaner-v6-24-11060; s_cc=true
Source: global traffic	HTTP traffic detected: GET /consent/831b8ee0-e952-49a5-af6b-01382c722774/508b8439-6d82-43c5-aed5-156f03a3876f/en.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=ZmsP-wAAAIn2VQN6 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=17054165488447196061006843670070479181
Source: global traffic	HTTP traffic detected: GET /sessions/857043?s=0.25&r=0.1398037801336809 HTTP/1.1Host: vc.hotjar.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.ccleaner.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /711037.gif?partner_uid=34646a75-9280-464b-864d-9b18d47ed789 HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?action=1&p_elm=0&p_lng=en&p_lid=en-us&p_geo=US&p_ads=1&p_devrsrch=1&p_thrdprt=1&p_thrdtr=1&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF3F882106AB5231C40D5B3E7F3FACDCDE&p_hid=cbec92ce-75e2-490f-bc67-2e710fa383e0&p_ubs=50&p_trs=0&p_alp=0&p_jar=0&p_cclic=&p_chcc=0&p_bld=mmm_ccl_003_999_a8f_m&p_dols=0&p_sols=0&p_pts=0&p_ftc=0&p_btc=0&p_pro=90&p_vep=6&p_ves=24&p_vbd=11060&p_osv=10.0&p_gksw=0&p_chr=0&p_sbi=0&p_scbu=0&p_tos=0&p_bau=0&p_dvt=3&p_bsls=0&p_gis=0&p_fds=172544&p_cco=0&p_ccgx=0&p_cce=1&p_cced=0&p_ccnsv=0&p_ccnu=0&p_ccna=0&p_ccnl=0&p_lit=0&p_age=0&p_tcy=0&p_pct=0&p_jct=0&p_lex=-1&p_ccgd=0&p_ccod=0&p_ccdb=0&p_pctn=0&p_iau=0&p_qcm=0&p_hcm=1&p_sum=1&p_ost=0&p_scr=1&p_fid=20240613 HTTP/1.1User-Agent: Mozilla/4.0 (CCleaner, 6.24.11060)Host: ipm-provider.ff.avast.comCache-Control: no-cacheCookie: ClientId=2e23bfc1-5968-4062-bf73-90a867e8cbb7
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=9eec2b4f-18cf-47d0-aef9-2b770df4d20b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21ebd08e-30b5-4548-bfb3-38e4516de518&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/2679475345708101?v=2.9.158&r=stable&domain=www.ccleaner.com&hme=446fb981c8c3baeb03730fe3cbd404f7f15f64c693f24c7fe75da498bc2c95d8&ex_m=67%2C113%2C100%2C104%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C160%2C163%2C174%2C170%2C171%2C173%2C28%2C94%2C50%2C73%2C172%2C155%2C158%2C167%2C168%2C175%2C122%2C14%2C48%2C180%2C179%2C124%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C101%2C103%2C37%2C102%2C29%2C25%2C156%2C159%2C131%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C98%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C99%2C43%2C75%2C65%2C105%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C106 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2013%20Jun%202024%2015%3A27%3A59%20GMT&n=4d&b=CCleaner%20v6.24.11060&.yp=10180940&f=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=9eec2b4f-18cf-47d0-aef9-2b770df4d20b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21ebd08e-30b5-4548-bfb3-38e4516de518&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adalyser.js?cid=ccleaner HTTP/1.1Host: c5.adalyser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-YG64G9XX0R&gacid=369076820.1718292481&gtm=45je46c0v872524127za200zb9132702579&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=275954779 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /j.php?a=176159&u=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&r=0.46631364871656444 HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cachedClickId?marketerId=001ac0827d67b7b38319c9517e7fa2f4cc HTTP/1.1Host: tr.outbrain.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&rl=&if=false&ts=1718292484258&sw=1280&sh=1024&v=2.9.158&r=stable&ec=0&o=4126&fbp=fb.1.1718292484251.360398822461210847&cs_est=true&ler=empty&cdl=API_unavailable&it=1718292478334&coo=false&dpo=&tm=1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source=navigation-source, triggerReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&rl=&if=false&ts=1718292484258&sw=1280&sh=1024&v=2.9.158&r=stable&ec=0&o=4126&fbp=fb.1.1718292484251.360398822461210847&cs_est=true&ler=empty&cdl=API_unavailable&it=1718292478334&coo=false&dpo=&tm=1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tracking/track/v3/p?stm=1718292485097&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&cid=ccleaner&p=%7B%22et%22%3A1718292485050%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22d6d1d6c6-5c5e-4152-a5d9-f8ff244f457b%22%2C%22duid%22%3A%221c594bba-780d-4dae-9307-891f9c7f4534%22%2C%22cw%22%3A1718292485050%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1Host: c5.adalyser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=DF22C6E31B0BCAD987EC92761D8B4F7D9&h=89eface1fc4c6fdd8376403837413aef&t=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=369076820.1718292481&jid=218115346&_u=YCDAgEABAAAAAGAEK~&z=1994015519 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ccleaner.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCenterRounded.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/v2/otPcCenter.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/6.36.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/static/poweredBy_ot_logo.svg HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v.gif?cd=0&a=176159&d=ccleaner.com&u=DF22C6E31B0BCAD987EC92761D8B4F7D9&h=89eface1fc4c6fdd8376403837413aef&t=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=9eec2b4f-18cf-47d0-aef9-2b770df4d20b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21ebd08e-30b5-4548-bfb3-38e4516de518&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: personalization_id="v1_+Jx6G80qwv2QmfDB8CyqfA=="
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=ZmsP-wAAAIn2VQN6 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=17054165488447196061006843670070479181; dpm=17054165488447196061006843670070479181
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s13604510390727?AQB=1&ndh=1&pf=1&t=13%2F5%2F2024%2011%3A27%3A57%204%20240&mid=17208700609507986630986886010044630524&aamlh=6&ce=UTF-8&pageName=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060&g=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&cc=USD&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&c14=D%3Dv16&v18=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&c35=D%3DpageName&c41=ccleaner&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-04-17&c48=CCleaner%20v6.24.11060&v48=D%3Dc49&c49=knowledge&v49=D%3Dc48&v57=17208700609507986630986886010044630524&c59=ccleaner%3Aknowledge%3Accleaner-v6-24-11060&v59=D%3Dc59&v72=ccleaner&c75=D%3Dv57&v96=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060&v164=ccleaner%3A999_a&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1034&bh=870&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.ccleaner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sourceCodeCookie=999_a8f\|\|source=direct\|medium=(none)\|campaign=(not set)\|segmentCode=a; __trSrc=999_a8f; sdl_cid=1985814156.1718292476; _gcl_au=1.1.353929047.1718292477; __srcCookie=007_z8f\|\|source=(Other)\|medium=(none)\|campaign=(not set)\|segmentCode=z; pglpid=undefined; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; s_nr=1718292477985-New; event69=event69; channelStack=s_eVar72~ccleaner; s_tbm=true; s_gpv=ccleaner%3Aus%3Aknowledge%3Accleaner-v6-24-11060; s_gpv_custom=ccleaner%3Aknowledge%3Accleaner-v6-24-11060; s_cc=true; avstperm=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1%2CC0005%3A1; cjConsent=MHxOfDB8Tnww; cjUser=34646a75-9280-464b-864d-9b18d47ed789; cjLiveRampLastCall=2024-06-13T15:27:59.171Z; OptanonConsent=isIABGlobal=false&datestamp=Thu+Jun+13+2024+11%3A27%3A59+GMT-0400+(Eastern+Daylight+Time)&version=6.36.0&hosts=&consentId=d2f71f62-cf53-4846-bbc5-b6b1b4b049b1&interactionCount=0&landingPath=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CBG232%3A1%2CC0004%3A1%2CC0005%3A1; _hjSessionUser_857043=eyJpZCI6IjI1MzQwYzY1LTA1OWYtNTdjNS1hYTIwLTEwNjZmNzliODk5MiIsImNyZWF0ZWQiOjE3MTgyOTI0Nzk2NjUsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_857043=eyJpZCI6ImU4MTlkNzQ2LWNhZGMtNGVlMS04ZTk3LTUwNTI0MmYxOGI2OSIsImMiOjE3MTgyOTI0Nzk2ODcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C19888%7CMCMID%7C17208700609507986630986886010044630524%7CMCAAMLH-1718897277%7C6%7CMCAAMB-1718897277%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1718299677s%7CNONE%7CMCSYNCSOP%7C411-198
Source: global traffic	HTTP traffic detected: GET /wi/config/10180940.json HTTP/1.1Host: s.yimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-69441-21&cid=369076820.1718292481&jid=218115346&gjid=2081911142&_gid=297172864.1718292485&_u=YCDAgEABAAAAAGAEK~&z=451009240 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkPYt3xDZhIP84hug563Asx3Tf_cA_TPJjIzz7g6UmBv49uePCQztmmd2hb
Source: global traffic	HTTP traffic detected: GET /sp.pl?a=10000&d=Thu%2C%2013%20Jun%202024%2015%3A27%3A59%20GMT&n=4d&b=CCleaner%20v6.24.11060&.yp=10180940&f=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe HTTP/1.1Host: sp.analytics.yahoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBAQQa2YCEHWbyIvgv5B7icMKHCM6vs4FEgEBAQFhbGZ0ZtxS0iMA_eMAAA&S=AQAAAkfHO7nSFgsREzo66H5TyTE
Source: global traffic	HTTP traffic detected: GET /tr/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&rl=&if=false&ts=1718292484258&sw=1280&sh=1024&v=2.9.158&r=stable&ec=0&o=4126&fbp=fb.1.1718292484251.360398822461210847&cs_est=true&ler=empty&cdl=API_unavailable&it=1718292478334&coo=false&dpo=&tm=1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=2679475345708101&ev=PageView&dl=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&rl=&if=false&ts=1718292484258&sw=1280&sh=1024&v=2.9.158&r=stable&ec=0&o=4126&fbp=fb.1.1718292484251.360398822461210847&cs_est=true&ler=empty&cdl=API_unavailable&it=1718292478334&coo=false&dpo=&tm=1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /563151391133/pageInfo HTTP/1.1Host: www.mczbf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-69441-21&cid=369076820.1718292481&jid=218115346&_u=YCDAgEABAAAAAGAEK~&z=1994015519 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=9eec2b4f-18cf-47d0-aef9-2b770df4d20b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=21ebd08e-30b5-4548-bfb3-38e4516de518&tw_document_href=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4ls7&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=ec5d6e80-b9b0-4ad5-8457-9064106d6c2c
Source: global traffic	HTTP traffic detected: GET /tracking/track/v3/p?stm=1718292485097&e=lce1&url=https%3A%2F%2Fwww.ccleaner.com%2Fknowledge%2Fccleaner-v6-24-11060%3Fcv%3Dv6-24-11060&cid=ccleaner&p=%7B%22et%22%3A1718292485050%2C%22nr%22%3A%22New%22%2C%22cg%22%3A%22Direct%22%2C%22dt%22%3A%22desktop%22%2C%22so%22%3A%22direct%22%2C%22me%22%3A%22none%22%2C%22ca%22%3A%22direct%22%2C%22co%22%3A%22(not%20set)%22%2C%22ke%22%3A%22(not%20set)%22%2C%22vid%22%3A%221%22%2C%22sid%22%3A%22d6d1d6c6-5c5e-4152-a5d9-f8ff244f457b%22%2C%22duid%22%3A%221c594bba-780d-4dae-9307-891f9c7f4534%22%2C%22cw%22%3A1718292485050%7D&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&domain=www.ccleaner.com HTTP/1.1Host: c5.adalyser.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: the next 30 days.Thank you for purchasing CCleaner Professional.CCleaner ActivationPopup/HealthCheck/PostAnalysis/UpgradedToTrialYour upgrade is complete.OKPopup/HealthCheck/PostAnalysis/UpgradedToProLatestICS.avast.commail.google.comlogin.live.comgoogle.com/accountswww.google.com/accountswww.google.comgoogle.com.piriform.com.ccleanercloud.com.ccleaner.commail.rumail.lycos.comovi.com/services/signinauth.me.comwww.mail.lycos.comlogin.comcast.neticloud.commail.aol.comwebmail.earthlink.netaccounts.google.commail.yahoo.commail.netscape.comwebmail.aol.comyahoo.comfastmail.fmmy.screenname.aol.comaol.comscreenname.aol.comtwitter.comfacebook.com5.41services.adobe.comProblemRegistry KeyDataCIssuesCtrl::SetControlsUsernameregistry.txtTrueCCScanreg.txt/bkpSelect allFix selected issues...cc_%d%02d%02d_%02d%02d%02d.regBackregReg Files (.reg).regScan For IssuesScan For Issues + CancelSystem.IO.File:GetDirectory() - Error code returned from _tsplitpath_s: System.IO.File:GetDirectory() - DirectoryName after removing trailing slash : Piriform::IO::File::GetDirectory, Drive: System.IO.File:GetDirectory() - FullPath: , Filename: , Directory: , Extension: (App)BKBNLicenseKeyLicense6Namelicense.inibusiness.datautotrial.dat25BrandoverBRANDING , Key: , Name: Trial Activation Trial License registered successfully. Filename: %s equals www.yahoo.com (Yahoo)
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: the next 30 days.Welcome!Popup/HealthCheck/PostAnalysis/UpgradedToProclickOKPopup/HealthCheck/PostAnalysis/UpgradedToTrialPNG0011TechnicianFreeccproccteCCleanerMozilla/4.0 (CCleaner, %s)BusinessProfessional%I64d&COMBOBOXccbeccfreecc%d\|\|LatestICS.avast.comgoogle.com/accountswww.google.com/accountsmail.google.comlogin.live.com%s%s - %sCCleanerBRANDING.ccleanercloud.com.ccleaner.com.piriform.com0mail.rumail.lycos.comfastmail.fmmy.screenname.aol.comwww.mail.lycos.comlogin.comcast.netovi.com/services/signinauth.me.comwebmail.earthlink.netaccounts.google.comwww.google.comgoogle.comwebmail.aol.comyahoo.commail.yahoo.commail.netscape.com\|5.41LatestICS0\|.avast.com.ccleanercloud.com.ccleaner.comscreenname.aol.comicloud.commy.screenname.aol.commail.aol.comservices.adobe.comtwitter.comfacebook.comaol.comLatestICSPNGEVENTS_WINDOW_MESSAGENOT_DEFINED%d.%02d.%03d#HttpOnly_Cookie:DOMStore:https://DOMStore:https://@DOMStore:http://DOMStore:http://.%d0011%I64d&COMBOBOXTools/RegistryDataProblemRegistryTASKBAR_NOTIFIER_CLICKED_MESSAGETaskbarSetProgressValueTaskbarSetProgressStateIDENTITY_EVENTS_WINDOW_MESSAGESelect allTools/RegistrytickSelect allclickBackTools/Registryuntick%dTahomaUsernameRegistry KeyclickFix selected issues...CIssuesCtrl::SetControlsScan For Issues + CancelSpecialKey1regclickScan For IssuesclickuntickTools/RegistrytickTools/RegistryReg Files (.reg)*.regCCleanercc_%d%02d%02d_%02d%02d%02d.regTools/Registry/scanreg\ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: analytics.avcdn.net
Source: global traffic	DNS traffic detected: DNS query: ipm-provider.ff.avast.com
Source: global traffic	DNS traffic detected: DNS query: service.piriform.com
Source: global traffic	DNS traffic detected: DNS query: license.piriform.com
Source: global traffic	DNS traffic detected: DNS query: shepherd.ff.avast.com
Source: global traffic	DNS traffic detected: DNS query: ip-info.ff.avast.com
Source: global traffic	DNS traffic detected: DNS query: ncc.avast.com
Source: global traffic	DNS traffic detected: DNS query: emupdate.avcdn.net
Source: global traffic	DNS traffic detected: DNS query: winqual.sb.avast.com
Source: global traffic	DNS traffic detected: DNS query: ccleaner.tools.avcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: s1.pir.fm
Source: global traffic	DNS traffic detected: DNS query: license-api.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: s7.addthis.com
Source: global traffic	DNS traffic detected: DNS query: s.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: c.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: cdn-production.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.nortonlifelock.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: amplify.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: s.yimg.com
Source: global traffic	DNS traffic detected: DNS query: mstatic.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: symantec.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.mczbf.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: tr.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: wave.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: oms.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: cdn-uat.ccleaner.com
Source: global traffic	DNS traffic detected: DNS query: vc.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: sp.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: c5.adalyser.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: dev.visualwebsiteoptimizer.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: driver-updater.ff.avast.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: zn4i1jhjmxub1nc6y-gendigital.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: 684dd32f.akstat.io
Source: global traffic	DNS traffic detected: DNS query: trial-eum-clientnsv4-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: trial-eum-clienttons-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: vx7puwyccdfbaztlcafq-phmeim-5a4d8991d-clientnsv4-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: 173-254-250-91_s-2-16-241-7_ts-1718292491-clienttons-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: download.avira.com

Source: unknown

HTTP traffic detected: POST /receive3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-enc-sbUser-Agent: Avast AntivirusContent-Length: 291Host: analytics.avcdn.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0Connection: closeDate: Thu, 13 Jun 2024 15:28:23 GMTX-Request-ID: 924f9a38-2999-11ef-8ea1-0f91389606c3Server: nginxX-Robots-Tag: noindex, nofollowX-Cache: Error from cloudfrontVia: 1.1 2e727a8c78efdc43baa0571190ea0f4a.cloudfront.net (CloudFront)X-Amz-Cf-Pop: AMS58-P2X-Amz-Cf-Id: 7urZOpSfyoMSG4KTGuKxYrAqTNi8lYQpEzH46EIW-1ErgXmfyx312Q==

Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://%s:%d;https=https://%s:%dHTTP/1.0%u.%u.%u.%u01234567890123456789abcdef0123456789ABCDEFCONOUT$
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://DOMStore:http://.%d0011%I64d&COMBOBOXTools/RegistryDataProblemRegistryTASKBAR_NOTIFIER_CLICKE
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1994785371.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ccsetup624.exe, 00000000.00000003.1950858815.0000000005203000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.too
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/c
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2140847610.0000000002ED0000.00000004.00000800.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A02000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/20180205.dll
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate029.cab
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate044.cab
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate10.cab
Source: CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000008.00000003.2125305271.000000000080D000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000008.00000002.2127089854.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/patches.ini
Source: CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/patches.ini_
Source: CCUpdate.exe, 00000007.00000002.2198509554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000007.00000000.2110048253.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000002.2126716554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000000.2124099830.00000000002A3000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/patches.inihttp://ccleaner.tools.avcdn.net/too
Source: CCUpdate.exe, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000008.00000003.2125305271.000000000080D000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000008.00000002.2127089854.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/updates.xml
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/updates.xml_
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/update/updates.xmls
Source: CCUpdate.exe, 00000007.00000002.2199836073.00000000009F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccleaner.tools.avcdn.net/tools/ccleaner/updateo
Source: ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.dig
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1994785371.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: ccsetup624.exe, 00000000.00000003.1950858815.0000000005203000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digobalRootCA.crl0=
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: ccsetup624.exe, 00000000.00000003.1950858815.0000000005203000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CCUpdate.exe	String found in binary or memory: http://emupdate.avcdn.net/files/emupdate/pong.txt
Source: CCUpdate.exe, 00000007.00000002.2198509554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000007.00000000.2110048253.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000002.2126716554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000000.2124099830.00000000002A3000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://emupdate.avcdn.net/files/emupdate/pong.txtAvEmUpdate
Source: CCUpdate.exe, 00000008.00000002.2127000475.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://emupdate.avcdn.net/files/emupdate/pong.txtPI32.dll
Source: CCUpdate.exe, 00000007.00000002.2199836073.00000000009D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://emupdate.avcdn.net/files/emupdate/pong.txtindows
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://files.avast.com/beta9x/avast_free_antivirus_setup_online.exeASWSig2A5549FF2866EA44F68D28FB2B1
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://files.avast.com/iavs9x/avast_premier_antivirus_setup_online.exeASWSig2A5FB1A9FDC683FA551EB348
Source: CCUpdate.exe	String found in binary or memory: http://honzik.avcdn.net/diffs/
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avast-tu/beta/avast_cleanup_online_setup.exeASWSig2A1E3DD1C1B204ED89FD
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avast-tu/release/avast_cleanup_online_setup.exeASWSig2A4C1A1197A19B18F
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exeASWSig2A2D7E61EA63DA
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-av/release/avg_internet_security_online_setup.exeASWSig2A40170EEB1
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-bs/beta/avg_battery_saver_online_setup.exeASWSig2A4D178CA216002CE0
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exeASWSig2A7E478FFFFFA84
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-tu/beta/avg_tuneup_online_setup.exeASWSig2A51F05E8C170B452F21205C3
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://honzik.avcdn.net/setup/avg-tu/release/avg_tuneup_online_setup.exeASWSig2A19497FDBA8D930F12196
Source: CCUpdate.exe	String found in binary or memory: http://honzik.avcdn.net/universe/
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://keys.backup.norton.com
Source: CCleaner64.exe, 00000005.00000002.2189752642.000002167E0C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ncc.avast.com/
Source: CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txt
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txtC-type
Source: CCleaner64.exe, 00000005.00000003.2160869578.000002167BB46000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2185766302.000002167BB46000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2156523100.000002167BB46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ncc.avast.com/ncc.txte
Source: CCleaner64.exe, 00000005.00000002.2189752642.000002167E0C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ncc.avast.com:80/ncc.txt
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: ccsetup624.exe, 00000000.00000000.1735482450.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1994785371.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ccsetup624.exe, 00000000.00000003.1950858815.0000000005203000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/MD/avast_streambacksubmit_%03d://http:Do
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/PD/avast_streambackraw_%03d://StreambackCommChannelAddr_asw::commchanne
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://p%03d.sb.avast.com/V1/PD/avast_streambackraw_%03d://http://p%03d.sb.avast.com/V1/MD/Canceling
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://posttestserver.com/a
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://posttestserver.com/avast_streambackraw_007://http://p004.sb.avast.com/V1/PD/avast_streambackr
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://posttestserver.com/test_channel_s://avast_streambackraw_generic://test_channel://avast_stream
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://sea20.ff.avast.com/browsercleanup://https://brain.jumpshot.com/avast/ss/queue/jumpshot_silent
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.avast.com0/
Source: ccsetup624.exe, 00000000.00000003.2100227003.0000000006380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/ccleaner
Source: ccsetup624.exe, 00000000.00000003.2293782893.0000000005177000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.2292691392.0000000005177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0
Source: ccsetup624.exe, 00000000.00000003.2292691392.0000000005152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=044rL
Source: ccsetup624.exe, 00000000.00000003.2293782893.0000000005177000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.2292691392.0000000005177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0om
Source: ccsetup624.exe, 00000000.00000003.2293782893.0000000005177000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.2292691392.0000000005177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0x8
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.ccleaner.com/inapp/notificationsContent-Type:
Source: ccsetup624.exe, 00000000.00000003.1950858815.0000000005203000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970406249.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1975889201.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1970509024.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1955656360.00000000051FD000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1950832067.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1976000730.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllNUL
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://DOMStore:https://.DOMStore:http://DOMStore:http://
Source: ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: ccsetup624.exe, 00000000.00000003.1955443164.0000000007440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://akbr-api.avast.com/activation?https://akbr-api.avast.com/acquisition?avast_creditmonitor://a
Source: CCleaner64.exe, 00000005.00000003.2165455521.000002167E152000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2185766302.000002167BB46000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2190497328.000002167E1E0000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2156523100.000002167BB46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/
Source: ccsetup624.exe, 00000000.00000003.1904288301.00000000034B8000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1882086455.00000000034B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/A
Source: ccsetup624.exe, 00000000.00000003.2013631498.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.2013518142.00000000050C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/Qc
Source: CCleaner64.exe, 00000005.00000003.2158517656.000002167E152000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2162353195.000002167E152000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2165455521.000002167E152000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2190229975.000002167E152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/omOIDZ
Source: CCleaner64.exe, 00000005.00000003.2166650443.000002167E0C9000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2189752642.000002167E0C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/p
Source: CCleaner64.exe, 00000005.00000003.2158517656.000002167E113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/receive3
Source: CCleaner64.exe, 00000005.00000002.2190229975.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2162353195.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2165455521.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2158517656.000002167E113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net/receive3Cvg
Source: CCleaner64.exe, 00000005.00000002.2190229975.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2162353195.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2165455521.000002167E113000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2158517656.000002167E113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net:443/receive3
Source: CCleaner64.exe, 00000005.00000002.2189752642.000002167E0C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.avcdn.net:443/receive31
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_FREE/platform_WIN/installertype_ONLINE/b
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_ONE_PRO/platform_WIN/installertype_ONLINE/bu
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_acknowledgements
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_license_agreement
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_data_factsheet
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_policy
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://ccleaner.com/go/app_cc_privacy_product_policy
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://download.avira.com/download/opswat-sdk-database/asw::su_controller::ControllerConfiguration:
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://download.avira.com/download/opswat-sdk-database/su_worker.exeasw::su_controller::ControllerC
Source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://hns-legacy.sb.avast.com
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-atrk/release/avast_antitrack_online_setup.exeASWSig2A532CCF5ABF
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/beta/avast_breach_guard_online_setup.exeASWSig2A6DF674D10553
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bg/release/avast_breach_guard_online_setup.exeASWSig2A2457920CE
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/beta/avast_battery_saver_online_setup.exeASWSig2A3A3BE3789E6
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-bs/release/avast_battery_saver_online_setup.exeASWSig2A072492C0
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/beta/avast_driver_updater_online_setup.exeASWSig2A3CBDA28891
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-du/release/avast_driver_updater_online_setup.exeASWSig2A021F36B
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avast-vpn/release/avast_vpn_online_setup.exeASWSig2A06FCDABA5742BE662
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exeASWSig2A2B99C8EA31CB6D
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/beta/avg_breach_guard_online_setup.exeASWSig2A56213C511B9A9241
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exeASWSig2A14AA13983E189
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-du/beta/avg_driver_updater_online_setup.exeASWSig2A667B4A5D8ECDBD
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-du/release/avg_driver_updater_online_setup.exeASWSig2A24A39E8D727
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://honzik.avcdn.net/setup/avg-vpn/release/avg_vpn_online_setup.exeASWSig2A27B1BBBA8E4138C4EDCFD
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/avg/beta9x/avg_internet_security_setup.exeASWSig2A7D77EF27F362060AF957E761
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/avg/iavs9x/avg_internet_security_setup.exeASWSig2A123D026AE3BEAC0AC7D4DC35
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/avg/iavs9x/avg_internet_security_setup.exeASWSig2A357ACEF8FE55D8ED7E2EA469
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/beta9x/avast_pro_antivirus_setup_online.exeASWSig2A579D90FED0C6441EE7B258F
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/iavs9x/avast_free_antivirus_setup_online.exeASWSig2A2EC0971AB07DE15C30023C
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://install.avcdn.net/iavs9x/avast_pro_antivirus_setup_online.exeASWSig2A03A4D7B0044FDD707267F64
Source: CCUpdate.exe, CCUpdate.exe, 00000007.00000002.2199836073.00000000009F3000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2122541870.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2122297021.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ip-info.ff.avast.com/v2/info
Source: CCUpdate.exe, 00000007.00000002.2199836073.00000000009F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ip-info.ff.avast.com/v2/infoG
Source: CCUpdate.exe, 00000007.00000002.2198509554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000007.00000000.2110048253.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000002.2126716554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000000.2124099830.00000000002A3000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://ip-info.ff.avast.com/v2/infocountry
Source: ccsetup624.exe, 00000000.00000003.2100522318.0000000007806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://license.piriform.com/product/v1/installcheck?p=1&v=6.24.11060&vx=&l=1033&b=1&o=10W6&g=0&i=1&
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://license.piriform.com/update%d.%d%s%dWExtra
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://license.piriform.com/update1033BaseUpdateProviderOnCustomErrorExtra
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://openid-stage.avast.comhttps://openid-stage.avg.compiriform_kamoavast_antitrackavg_antitrackp
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://openid.avg.comhttps://openid.avast.commy-devices.avast.commy-win.avast.comalpha-rollout-serv
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://piriform.zendesk.com/hc/en-us/articles/204043884-Using-CCleaner-s-Drive-Wiper
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://piriform.zendesk.com/hc/en-us/articles/218109957-How-do-I-manage-browser-plugins-
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://posttestserver.com/test_channel_utf8://avast_activationcodelegacy://avast_creditmonitor://ht
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://s-trackoff.avcdn.net/avg/trackoff/7854df286ff1c4e1f4d81d466f4a1b0243b39837ac99c5b98817907f76
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://s-trackoff.avcdn.net/trackoff/8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850fa
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://sciter.com/forums/topic/plus-custom-output-formatter-wont-work-if-they-are-written-in-htm/#p
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://secure.ccleaner.com/502/uurl-90zu4qtn5p?
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://secure.ccleaner.com/502/uurl-90zu4qtn5p?x-source=833
Source: ccsetup624.exe, 00000000.00000003.2046526158.0000000007805000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.2100522318.0000000007806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shepherd.ff.avast.com/?p_vep=6&p_ves=24&p_vbd=11060&p_lit=0&p_midex=3F5C7CD44D1F6AC769934CAD
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://softwareupdatechecker.live-everest-media.net/api/v1/ProgramDefinitions/api/v1/ScanResultshtt
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://softwareupdatechecker.staging-everest-media.netUsing
Source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://submit.sb.avast.com
Source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://viruslab-samples.sb.avast.com
Source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://winqual.sb.avast.com
Source: CCleanerBugReport.exe, 00000009.00000003.2142971191.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2142277390.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000002.2144826660.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winqual.sb.avast.com/
Source: CCleanerBugReport.exe, 00000009.00000003.2142971191.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2142277390.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000002.2144826660.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winqual.sb.avast.com/V1/MD
Source: CCleanerBugReport.exe, 00000009.00000002.2145070541.000001BF0D749000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2142147632.000001BF0D747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winqual.sb.avast.com/V1/MD-
Source: CCleanerBugReport.exe, 00000009.00000003.2142971191.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2142277390.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000002.2144826660.000001BF0D707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winqual.sb.avast.com/V1/MDT
Source: CCleanerBugReport.exe, 00000009.00000003.2142589596.000001BF0D725000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000002.2144964988.000001BF0D725000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2143893572.000001BF0D725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winqual.sb.avast.com:443/V1/MDi
Source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://winqual.sb.avast.comhttps://hns-legacy.sb.avast.comhttps://submit.sb.avast.comhttps://virusl
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.avast.com/lp-ppc-nbu-fav-cc
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/business
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/business/ccleaner-business-edition
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/ccleaner
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/ccleaner/browser
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/docs/ccleaner/ccleaner-settings/choosing-which-cookies-to-keep
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/docs/ccleaner/using-ccleaner/browser-cleaning
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/docs/ccleaner/using-ccleaner/managing-auto-starting-programs
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/docs/ccleaner/using-ccleaner/uninstalling-programs
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_help_performance_optimizer
Source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_help_preloading
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_cc_help_schedule_setup?utm_source=ccleaner&utm_medium=application&ut
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_deactivated_help
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_du_support
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_du_survey
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_du_systemprotection
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_du_systemrestoreinfo
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_no_license_error
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C3135000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ccleaner.com/go/app_po_survey
Source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.ssllabs.com/ssltest/viewMyClient.htmlLoading...purlEnter

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50400
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50499
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 50497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50455
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50469
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 50499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.209.22:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.149.62:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.111.24.1:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.202.126:443 -> 192.168.2.4:50400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:50498 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell

Reads the System eventlog

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Contains functionality to call native functions

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0023DF0A __EH_prolog3_catch_GS,GetCurrentProcessId,CreateFileW,GetLastError,Sleep,GetLastError,WriteFile,WriteFile,WriteFile,WriteFile,GetFileSizeEx,NtSetInformationFile,OutputDebugStringW,CloseHandle,

7_2_0023DF0A

Contains functionality to communicate with device drivers

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_002613F0: GetSystemDirectoryW,GetLastError,GetVolumePathNameW,GetLastError,GetVolumeNameForVolumeMountPointW,GetLastError,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,

7_2_002613F0

Contains functionality to launch a process as a different user

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_00241989 __EH_prolog3,CreateProcessW,CreateEnvironmentBlock,CreateProcessAsUserW,GetLastError,WaitForSingleObject,GetExitCodeProcess,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,

7_2_00241989

Creates files inside the system directory

Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Windows\Tasks\CCleanerCrashReporting.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Detected potential crypto function

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002623C0	7_2_002623C0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0025B8D0	7_2_0025B8D0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00258AC0	7_2_00258AC0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00253FAB	7_2_00253FAB
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0025D040	7_2_0025D040
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00223080	7_2_00223080
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00268090	7_2_00268090
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002301B2	7_2_002301B2
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00267290	7_2_00267290
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00234330	7_2_00234330
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0026A350	7_2_0026A350
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002273A0	7_2_002273A0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0023138E	7_2_0023138E
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0028E3E9	7_2_0028E3E9
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0025E460	7_2_0025E460
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00232488	7_2_00232488
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002684D0	7_2_002684D0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0025F5F0	7_2_0025F5F0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0028F6AA	7_2_0028F6AA
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0025F70D	7_2_0025F70D
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002867E8	7_2_002867E8
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002887D0	7_2_002887D0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0026B830	7_2_0026B830
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0027B86A	7_2_0027B86A
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0022F844	7_2_0022F844
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0026C8D0	7_2_0026C8D0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0026C9C0	7_2_0026C9C0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0022DAA5	7_2_0022DAA5
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00267AC0	7_2_00267AC0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0027BBB2	7_2_0027BBB2
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00294C77	7_2_00294C77
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00267D40	7_2_00267D40
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00230E65	7_2_00230E65
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0024CEFB	7_2_0024CEFB
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0027BF17	7_2_0027BF17
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00296FC9	7_2_00296FC9
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C
Source: C:\Program Files\CCleaner\CCleaner.exe	Code function: 11_3_05A0A41C	11_3_05A0A41C

Found potential string decryption / allocating functions

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 0023DEFB appears 188 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 0023E3A4 appears 94 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 00274305 appears 41 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 0027D493 appears 81 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 0028A3D9 appears 37 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 002742D2 appears 137 times
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: String function: 00274630 appears 62 times

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 6472 -ip 6472

PE file contains executable resources (Code or Archives)

Source: lang-1034.dll.0.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: lang-1036.dll.0.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.109
Source: lang-1036.dll.0.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1038.dll.0.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped
Source: lang-1043.dll.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: lang-1043.dll.0.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1045.dll.0.dr	Static PE information: Resource name: RT_STRING type: 370 XA sysV executable not stripped
Source: lang-1048.dll.0.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1050.dll.0.dr	Static PE information: Resource name: RT_STRING type: iAPX 286 executable large model (COFF) not stripped
Source: lang-1053.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1055.dll.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1026.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1026.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1056.dll.0.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1057.dll.0.dr	Static PE information: Resource name: RT_STRING type: 370 sysV pure executable not stripped
Source: lang-1057.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1057.dll.0.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1058.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: lang-1060.dll.0.dr	Static PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: lang-1060.dll.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: lang-1063.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1063.dll.0.dr	Static PE information: Resource name: RT_STRING type: x86 executable (TV) not stripped
Source: lang-1063.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1065.dll.0.dr	Static PE information: Resource name: RT_STRING type: x86 executable (TV) not stripped
Source: lang-1065.dll.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1066.dll.0.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1032.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: lang-1032.dll.0.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: lang-1032.dll.0.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: lang-1034.dll0.0.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: lang-1036.dll0.0.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.109
Source: lang-1036.dll0.0.dr	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: lang-1038.dll0.0.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped
Source: lang-1081.dll.0.dr	Static PE information: Resource name: RT_STRING type: x86 executable not stripped
Source: lang-1081.dll.0.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)

PE file does not import any functions

Source: lang-1050.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1041.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1056.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1035.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1038.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1053.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1044.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1026.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1081.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1032.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1063.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1034.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1040.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1036.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1028.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1034.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1040.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1057.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1062.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1045.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1051.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1068.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1027.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1079.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1037.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1067.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1058.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1055.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1052.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1043.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1046.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1049.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1061.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1060.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1031.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1037.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1066.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1054.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1025.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1048.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1038.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1029.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1036.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1071.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1030.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1065.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1042.dll.0.dr	Static PE information: No import functions for PE file found
Source: lang-1035.dll0.0.dr	Static PE information: No import functions for PE file found
Source: lang-1059.dll.0.dr	Static PE information: No import functions for PE file found

Uses 32bit PE files

Source: ccsetup624.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: sus36.spyw.evad.winEXE@52/442@173/45

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_002418BA GetCurrentThread,OpenThreadToken,OpenThreadToken,GetLastError,GetLastError,ImpersonateSelf,GetLastError,OpenThreadToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

7_2_002418BA

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_00243B74 __EH_prolog3_align,VariantInit,CoCreateInstance,VariantClear,VariantClear,CoCreateInstance,

7_2_00243B74

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_00229BC1 LoadResource,LockResource,SizeofResource,

7_2_00229BC1

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_00241C09 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,QueryServiceStatus,QueryServiceStatusEx,ControlService,ControlService,Sleep,QueryServiceStatus,OpenProcess,TerminateProcess,CloseHandle,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

7_2_00241C09

Source: C:\Users\user\Desktop\ccsetup624.exe

File created: C:\Program Files\CCleaner

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup624.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MI9CPE8L.txt

Jump to behavior

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Mutant created: NULL
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTraySingleIcon
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6472
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_Monitoring
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_MainInstance
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\AvastBugReport-F44FD5F2-ED43-485f-8A66-041B81E21AC2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_PreventSecondInstance
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_Checking_for_Updates
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTrayMonitorIconActive
Source: C:\Program Files\CCleaner\CCUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\CCleanerSetupMutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03
Source: C:\Program Files\CCleaner\CCleaner64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Piriform_CCleaner_SystemTrayIconActive

Source: C:\Users\user\Desktop\ccsetup624.exe

File created: C:\Users\user\AppData\Local\Temp\nslD72B.tmp

Jump to behavior

Source: ccsetup624.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ccsetup624.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor

Source: C:\Users\user\Desktop\ccsetup624.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ccsetup624.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2133624427.00000000028A4000.00000008.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000002.2182337056.00000000028B1000.00000008.00000001.01000000.00000019.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2133624427.00000000028A4000.00000008.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000002.2182337056.00000000028B1000.00000008.00000001.01000000.00000019.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: CCUpdate.exe

String found in binary or memory: /installer

Source: C:\Users\user\Desktop\ccsetup624.exe

File read: C:\Users\user\Desktop\ccsetup624.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ccsetup624.exe "C:\Users\user\Desktop\ccsetup624.exe"
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg
Source: unknown	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe"
Source: unknown	Process created: C:\Program Files\CCleaner\CCleanerBugReport.exe "C:\Program Files\CCleaner\CCleanerBugReport.exe" --product 90 --send dumps\|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --guid "cbec92ce-75e2-490f-bc67-2e710fa383e0" --version "6.24.11060" --silent
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\CCleaner\CCleaner.exe "C:\Program Files\CCleaner\CCleaner.exe" 0
Source: C:\Program Files\CCleaner\CCleaner.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner.exe" 0
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=0
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1904,i,2080959678102161561,3568569212771411705,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe "C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe"
Source: unknown	Process created: C:\Windows\System32\wbem\unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe --pid=4108
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe --pid=6472
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 6472 -ip 6472
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6472 -s 8068
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll"	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner.exe" 0
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe --pid=6472
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1904,i,2080959678102161561,3568569212771411705,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe --pid=4108
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 6472 -ip 6472
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6472 -s 8068
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxgi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winmm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: secur32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: urlmon.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: oleacc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: usp10.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iertutil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: srvcli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netutils.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskschd.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dbgcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mstask.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: version.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wldp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: profapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: webio.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mswsock.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winnsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: atlthunk.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: winsta.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d2d1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwrite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d11.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dcomp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: textshaping.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wscapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netprofm.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: newdev.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: devobj.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: devrtl.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dxcore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: amsi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: xmllite.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: schannel.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wintypes.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: appresolver.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: slc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: sppc.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: propsys.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: linkinfo.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntshrui.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cscapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: policymanager.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: taskflowdataengine.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: cdp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dsreg.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: gpapi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: esent.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msimg32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: edputil.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: drvstore.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: spinf.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: wininet.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: libwaheap.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: libwautils.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: msi.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: authz.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: netapi32.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: samcli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: logoncli.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: dsparse.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: version.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wininet.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winhttp.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cabinet.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: userenv.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: powrprof.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: umpdc.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: webio.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mswsock.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: winnsi.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: sspicli.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: schannel.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: msasn1.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: gpapi.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dpapi.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\CCleaner\CCUpdate.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Section loaded: userenv.dll

Source: C:\Users\user\Desktop\ccsetup624.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Program Files\CCleaner\CCUpdate.exe

File written: C:\Program Files\CCleaner\Setup\cd5ed1e5-b9ec-43a5-92fa-721007ae7216.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\ccsetup624.exe	Automated click: Install
Source: C:\Users\user\Desktop\ccsetup624.exe	Automated click: OK
Source: C:\Users\user\Desktop\ccsetup624.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 13
Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 13
Source: C:\Program Files\CCleaner\CCleaner64.exe	Window detected: Number of UI elements: 13

Uses Microsoft Silverlight

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaheap.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwalocal.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwaresource.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwautils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Directory created: C:\Program Files\CCleaner\uninst.exe	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Setup\config.def	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\cd5ed1e5-b9ec-43a5-92fa-721007ae7216.ini	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Directory created: C:\Program Files\CCleaner\Setup\5f657c67-a31a-41b8-a111-f1acbb9f600c.xml	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Directory created: C:\Program Files\CCleaner\log\BugReport.log.tmp.ba3d061e-a5d6-48dc-8ffe-ac0babbb6a3d	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Directory created: C:\Program Files\CCleaner\log\BugReport.status	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log.tmp.d774a070-945b-4037-99c1-7f7214253f48
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEng.log.tmp.c72224d4-4032-4506-8529-a0862ddbd6ea
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log.tmp.edb72a92-e2b2-47b3-a474-edfb542af7f1
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\journal
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\log
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\report
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\chest
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\moved
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\fw
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\event_manager.log.tmp.700487c0-14db-4a4a-bbd5-a4a14a007439
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\usercfg.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\BackupStorage
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\20c26c95-aefa-4c4a-a131-fdebc087b51e
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-08-468.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-17-091.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-26-405.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-30-36-438.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\state_cache.json.{1BC2E4AC-BDC0-4BFF-A0E6-C73932CE4EC9}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\e4e02ba7-b8e3-4656-b16c-1c6154bda034
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_controller.log.tmp.9fbf1b57-2a09-404d-ab05-ecfadef76b79
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_telemetry.log.tmp.a2504234-4a25-463a-bff1-dda1306bfdd2
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\825E3DD4-926B-4EB9-A66E-9F88AAD28A0F
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\44ED97C8-2D40-4A50-913D-673F6858B9AF
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\a913d86d-d3f4-4e76-a21e-e0a66af3739d
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\su_adapter.log.tmp.13b91b14-6577-40bd-98f0-f47b43ce0131
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\DUState.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-07-948.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\InitialDUState V23_4.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-18-898.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-28-680.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\StateHistory\DUState 2024-06-13 15-29-38-103.dat
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\Data\state_cache.json.{32F5E59D-14FB-44CA-856F-43B0FFE9EDB5}
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\burger_client\8866F8A9-70C9-43A2-BFBE-EE00AA2DC417\8d965214-8ffd-49d5-bf57-6d07f021c978
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\LOG\unp311126142200928707i-unhandled.mdmp
Source: C:\Program Files\CCleaner\CCleaner64.exe	Directory created: C:\Program Files\CCleaner\gcapi_dll.dll
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Directory created: C:\Program Files\CCleaner\LOG\pd.log.tmp.72028699-14f0-4c06-a2c4-18e38d276c7d

Creates a software uninstall entry

Source: C:\Users\user\Desktop\ccsetup624.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner

Jump to behavior

PE / OLE file has a valid certificate

Source: ccsetup624.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: ccsetup624.exe

Static file information: File size 83689152 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: ccsetup624.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: gcapi_dll.dll.pdb\| source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\_av\BUILDS\Release\x86\emupdate.pdb source: CCUpdate.exe, 00000007.00000003.2150005470.0000000000A78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x64\CCleaner64.pdb source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x86\CCleaner.pdb# source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\AvastClient\BUILDS\Release\x64\CCleanerBugReport.pdb source: CCleanerBugReport.exe, 00000009.00000002.2146241208.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp, CCleanerBugReport.exe, 00000009.00000000.2125023745.00007FF73BF6D000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: gcapi_dll.dll.pdb source: CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2EE3000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: gcapi_dll.dll.pdbpf source: CCleaner.exe, 0000000B.00000000.2134045148.0000000002D9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\BUILD\work\67d9289f94964a81\BUILDS\Release\x86\CCUpdate.pdb source: CCUpdate.exe, 00000007.00000002.2198509554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000007.00000000.2110048253.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000002.2126716554.00000000002A3000.00000002.00000001.01000000.00000017.sdmp, CCUpdate.exe, 00000008.00000000.2124099830.00000000002A3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\BUILD\work\1878ef5ed829e50b\bin\CCleaner\Release Static\x86\CCleaner.pdb source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0023BA23 __EH_prolog3_GS,GetCommandLineW,GetSystemTime,GetDateFormatW,GetTimeFormatW,GetVersionExW,GetLastError,GetNativeSystemInfo,CallNtPowerInformation,GlobalMemoryStatusEx,GetCurrentProcess,GetSystemDirectoryW,GetLastError,LoadLibraryW,GetProcAddress,FreeLibrary,GetSystemWow64DirectoryW,GetModuleFileNameW,GetFileAttributesExW,_wcsrchr,GetPrivateProfileStringW,GetPrivateProfileSectionW,CreateDirectoryW,GetTempPathW,GetCurrentDirectoryW,_wcsrchr,

7_2_0023BA23

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002742A0 push ecx; ret		7_2_002742B3
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0029A90B push ecx; ret		7_2_0029A920

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u	7_2_00261760
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u	7_2_002619E0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u	7_2_00261D00

Drops PE files

Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1026.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCUpdate.exe	File created: C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_17182924576472.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwaheap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1044.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_17182924724108.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\pfUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwalocal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerBugReport.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwaapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\p\ServiceUninstaller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwaresource.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\p\pfBL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\libwautils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\g\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\a\asdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	File created: C:\Program Files\CCleaner\gcapi_17182924693868.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1062.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1028.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\CCleaner.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to dropped file

Source: C:\Program Files\CCleaner\CCUpdate.exe

7_2_0023BA23

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u	7_2_00261760
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u	7_2_002619E0
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u	7_2_00261D00

Creates job files (autostart)

Source: C:\Program Files\CCleaner\CCleaner64.exe

File created: C:\Windows\Tasks\CCleanerCrashReporting.job

Jump to behavior

Creates or modifies windows services

Source: C:\Program Files\CCleaner\CCleaner64.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url	Jump to behavior

Source: C:\Program Files\CCleaner\CCUpdate.exe

7_2_00241C09

Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CCleaner Smart Cleaning
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CCleaner Smart Cleaning

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\ccsetup624.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE

Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000012.00000003.2384834604.00000194E4DD4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2383185325.00000194ED024000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2384556930.00000194ED2FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2383510265.00000194ED14B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2382716752.00000194EC6FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ccsetup624.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCUpdate.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	System information queried: FirmwareTableInformation

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: C50000 memory reserve \| memory write watch
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: 56D0000 memory reserve \| memory write watch
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: 4470000 memory reserve \| memory write watch
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: 8D0000 memory reserve \| memory write watch
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: 56D0000 memory reserve \| memory write watch
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Memory allocated: 76D0000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Horizon View Client
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Player
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Workstation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files\VMware\VMware Player
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Horizon View Client
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened / queried: C:\Program Files (x86)\VMware\VMware Workstation

Contains long sleeps (>= 3 min)

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 900000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899665
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899501
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898826
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896750
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895876
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895362
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894844
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894065
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893846
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893674
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893472
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893268
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893080
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892908
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892705
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892455
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892268
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892096
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891799
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891533
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891349
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890796
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890468
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890182
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889930
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889721
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889321
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888938
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888657
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888313
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887782
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887431
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886391
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885719
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885485
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885265
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885032
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884742
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884609
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884423
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884282
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884106
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883813
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883079
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882938
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882766
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882391
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882224
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881970
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881688
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881423
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881063
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880532
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879626
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879282
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879001
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878748
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878360
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878047
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877531
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877170
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876879
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876656
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876359
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876093
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875796
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875617
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875265
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874812
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874656
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874421
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874228
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873875
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873671
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873525
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873139
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873011
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872867
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872747
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872637
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872312
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872202
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872077
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871947
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871828
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871704
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871578
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871460
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871313
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871078
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870906
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870642
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870344
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870164
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869859
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869749
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869641
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869515
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869402
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869281
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869171
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868904
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868762
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868635
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868528
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868404
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868280
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867950
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867828
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867673
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867547
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867435
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867312
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867144
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867015
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866905
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866770
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866572
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866431
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866264
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866155
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866046
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865925
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865797
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865687
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865573
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 900000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899716
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899488
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899042
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898610
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898314
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897985
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897454
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897103
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896595
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896079
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895548
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895392
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895157
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894937
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894704
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894414
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894281
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894095
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893954
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893778
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893485
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893267
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892751
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892622
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892439
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892064
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891897
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891657
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891360
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891095
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890470
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890204
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889298
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889001
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888750
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888449
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888032
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887204
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886842
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886551
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886031
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885766
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885469
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885289
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884986
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884797
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884641
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884406
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884187
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884025
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883812
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883197
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882811
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882683
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882540
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882419
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882310
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881984
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881875
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881748
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881620
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881376
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881250
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881132
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880824
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880645
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880344
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880078
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879703
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879547
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879407
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879296
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879063
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878953
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878844
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878732
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878576
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878434
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878308
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878201
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878091
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877981
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877742
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877638
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877516
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877354
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877219
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877107
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876984
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876816
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876703
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876484
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876373
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876233
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876103
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875936
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875827
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875719
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875484
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875375
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875253
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875141
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874906

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Window / User API: threadDelayed 7570
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Window / User API: threadDelayed 1810
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Window / User API: threadDelayed 7028
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Window / User API: threadDelayed 2455

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1026.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1081.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCUpdate.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Setup\edaae633-e6ff-40e6-b5f6-86f9db8bf8d2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1055.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_17182924576472.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1044.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_17182924724108.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2070.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1030.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1060.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1067.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1042.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-3098.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\pfUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwalocal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1071.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-5146.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1155.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1087.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1057.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1044.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1052.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwaapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1046.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1065.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1029.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1063.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1050.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1093.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerReactivator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1038.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\p\ServiceUninstaller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1035.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwavmodapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1027.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\libwaresource.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1048.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1079.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1036.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1061.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1031.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1037.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\p\pfBL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1068.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1025.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1090.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-9999.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1104.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1041.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1054.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1081.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1056.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\g\gcapi_dll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1051.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1102.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1055.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\a\asdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1060.dll	Jump to dropped file
Source: C:\Program Files\CCleaner\CCleaner64.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\gcapi_17182924693868.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1026.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1062.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1043.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1049.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1066.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1053.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1028.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-2074.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-2070.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1092.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1109.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerReactivator.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1062.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleanerDU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1032.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1045.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1058.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\lang-1034.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ccsetup624.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\Lang\lang-1028.dll	Jump to dropped file

Found evasive API chain (may stop execution after accessing registry keys)

Source: C:\Program Files\CCleaner\CCUpdate.exe

Evasive API call chain: RegQueryValue,DecisionNodes,Sleep

graph_7-54004

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Program Files\CCleaner\CCUpdate.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_7-52481

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\ccsetup624.exe TID: 7104	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 4632	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 2120	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe TID: 4600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 2136	Thread sleep time: -120000s >= -30000s
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 7128	Thread sleep time: -90000s >= -30000s
Source: C:\Program Files\CCleaner\CCUpdate.exe TID: 7128	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1460	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 7696	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\CCleaner\CCleaner64.exe TID: 7296	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2336	Thread sleep count: 7570 > 30
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -900000s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -899665s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -899501s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -899251s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -899016s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -898826s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -897735s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -897172s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -896750s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -895876s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -895362s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -894844s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -894065s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -893846s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -893674s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -893472s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -893268s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -893080s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -892908s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -892705s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -892455s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -892268s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -892096s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -891799s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -891533s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -891349s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -891126s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -890796s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -890468s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -890182s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -889930s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -889721s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -889321s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -888938s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -888657s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -888313s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -888126s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -887782s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -887431s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -886923s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -886391s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -886126s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -885860s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -885719s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -885485s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -885265s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -885032s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -884742s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -884609s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -884423s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -884282s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -884106s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -883813s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -883594s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -883251s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -883079s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -882938s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -882766s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -882391s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -882224s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -881970s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -881688s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -881423s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -881063s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -880798s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -880532s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -880251s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -879626s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -879282s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -879001s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -878748s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -878360s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -878047s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -877531s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -877170s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -876879s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -876656s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -876359s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -876093s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -875796s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -875617s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -875265s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -875059s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -874812s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -874656s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -874421s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -874228s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873875s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873671s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873525s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873328s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873139s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -873011s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872867s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872747s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872637s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872500s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872312s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872202s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -872077s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871947s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871828s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 7364	Thread sleep count: 1810 > 30
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871704s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871578s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871460s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871313s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -871078s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -870906s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -870642s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -870344s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -870164s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -870016s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869859s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869749s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869641s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869515s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869402s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869281s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869171s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -869059s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868904s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868762s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868635s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868528s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868404s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868280s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868172s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -868059s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867950s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867828s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867673s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867547s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867435s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867312s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867144s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -867015s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866905s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866770s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866572s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866431s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866264s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866155s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -866046s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -865925s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -865797s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -865687s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 2056	Thread sleep time: -865573s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 6028	Thread sleep count: 7028 > 30
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -900000s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -899716s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -899488s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -899042s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -898610s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -898314s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -897985s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -897798s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -897454s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -897103s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -896595s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -896079s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -895798s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -895548s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -895392s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -895157s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -894937s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -894704s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -894414s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -894281s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -894095s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -893954s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -893778s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -893485s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -893267s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -892923s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -892751s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -892622s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -892439s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -892064s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -891897s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -891657s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -891360s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -891095s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -890735s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -890470s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -890204s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -889923s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -889298s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -889001s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -888750s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -888449s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -888032s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -887735s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -887204s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -886842s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -886551s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -886328s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -886031s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -885766s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -885469s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -885289s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884986s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884797s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884641s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884406s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884187s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -884025s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -883812s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -883500s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -883328s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -883197s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -883000s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882811s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882683s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882540s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882419s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882310s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -882172s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881984s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881875s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881748s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881620s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881500s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881376s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881250s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881132s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -881000s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -880824s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -880645s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -880344s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -880078s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879860s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879703s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879547s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879407s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 6028	Thread sleep count: 2455 > 30
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879296s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879172s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -879063s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878953s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878844s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878732s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878576s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878434s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878308s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878201s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -878091s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877981s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877860s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877742s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877638s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877516s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877354s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877219s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -877107s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876984s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876816s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876703s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876594s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876484s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876373s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876233s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -876103s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875936s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875827s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875719s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875594s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875484s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875375s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875253s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875141s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -875016s >= -30000s
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe TID: 5812	Thread sleep time: -874906s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\Desktop\ccsetup624.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ccsetup624.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Users\user\Desktop\ccsetup624.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Bios
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Bios
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,SMBIOSBIOSVersion,IdentificationCode,SerialNumber,ReleaseDate,Version FROM Win32_BIOS
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model,Manufacturer,Name,SerialNumber FROM Win32_BaseBoard

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files\CCleaner\CCleaner64.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ccsetup624.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor
Source: C:\Program Files\CCleaner\CCleaner64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UniqueId,ProcessorId,Name,Manufacturer FROM Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\CCleaner\CCleaner64.exe	Last function: Thread delayed

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00237F2F GetSystemTime followed by cmp: cmp esi, 06h and CTI: je 0023808Fh	7_2_00237F2F
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00237F2F GetSystemTime followed by cmp: cmp esi, 05h and CTI: je 0023808Fh	7_2_00237F2F
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00237F2F GetSystemTime followed by cmp: cmp esi, 04h and CTI: je 0023808Fh	7_2_00237F2F
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00237F2F GetSystemTime followed by cmp: cmp esi, 03h and CTI: je 0023808Fh	7_2_00237F2F
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00237F2F GetSystemTime followed by cmp: cmp esi, 02h and CTI: je 0023808Fh	7_2_00237F2F

Source: C:\Users\user\Desktop\ccsetup624.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002500EB __EH_prolog3_GS,FindFirstFileW,_wcsrchr,GetFileAttributesW,FindNextFileW,FindClose,	7_2_002500EB
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00293665 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00293665
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0023ECE0 __EH_prolog3_GS,FindFirstFileW,SetFileAttributesW,DeleteFileW,GetLastError,Sleep,FindNextFileW,SetFileAttributesW,RemoveDirectoryW,GetLastError,FindClose,	7_2_0023ECE0

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0025E8F0 GetSystemInfo,GetVersionExW,GetVersionExW,RtlGetVersion,GetModuleHandleW,GetProcAddress,RtlGetVersion,

7_2_0025E8F0

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 900000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899665
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899501
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898826
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896750
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895876
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895362
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894844
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894065
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893846
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893674
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893472
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893268
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893080
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892908
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892705
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892455
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892268
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892096
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891799
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891533
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891349
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890796
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890468
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890182
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889930
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889721
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889321
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888938
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888657
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888313
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887782
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887431
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886391
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886126
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885719
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885485
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885265
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885032
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884742
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884609
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884423
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884282
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884106
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883813
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883079
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882938
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882766
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882391
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882224
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881970
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881688
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881423
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881063
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880532
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880251
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879626
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879282
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879001
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878748
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878360
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878047
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877531
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877170
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876879
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876656
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876359
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876093
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875796
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875617
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875265
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874812
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874656
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874421
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874228
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873875
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873671
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873525
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873139
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 873011
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872867
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872747
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872637
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872312
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872202
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 872077
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871947
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871828
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871704
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871578
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871460
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871313
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 871078
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870906
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870642
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870344
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870164
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 870016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869859
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869749
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869641
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869515
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869402
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869281
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869171
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 869059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868904
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868762
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868635
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868528
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868404
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868280
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 868059
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867950
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867828
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867673
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867547
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867435
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867312
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867144
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 867015
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866905
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866770
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866572
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866431
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866264
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866155
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 866046
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865925
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865797
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865687
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 865573
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 900000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899716
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899488
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 899042
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898610
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 898314
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897985
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897454
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 897103
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896595
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 896079
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895798
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895548
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895392
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 895157
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894937
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894704
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894414
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894281
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 894095
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893954
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893778
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893485
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 893267
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892751
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892622
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892439
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 892064
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891897
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891657
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891360
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 891095
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890470
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 890204
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889923
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889298
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 889001
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888750
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888449
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 888032
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887735
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 887204
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886842
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886551
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 886031
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885766
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885469
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 885289
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884986
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884797
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884641
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884406
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884187
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 884025
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883812
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883328
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883197
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 883000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882811
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882683
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882540
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882419
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882310
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 882172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881984
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881875
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881748
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881620
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881500
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881376
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881250
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881132
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 881000
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880824
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880645
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880344
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 880078
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879703
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879547
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879407
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879296
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879172
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 879063
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878953
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878844
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878732
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878576
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878434
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878308
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878201
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 878091
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877981
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877860
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877742
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877638
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877516
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877354
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877219
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 877107
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876984
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876816
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876703
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876484
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876373
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876233
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 876103
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875936
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875827
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875719
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875594
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875484
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875375
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875253
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875141
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 875016
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Thread delayed: delay time: 874906

Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey4=%LocalAppData%\VMware\|*.log
Source: CCleanerBugReport.exe, 00000009.00000002.2145207042.000001BF0D773000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2143065234.000001BF0D772000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2142002579.000001BF0D76E000.00000004.00000020.00020000.00000000.sdmp, CCleanerBugReport.exe, 00000009.00000003.2141898246.000001BF0D76E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: CCleaner64.exe, 00000005.00000002.2185607122.000002167BB30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPD
Source: CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: onPasteKeyonUserNameonLicenseKeyisPreviousAvailablegetKeyboardLanguageonManageSubscriptiononActivateNewKeyonAlphaUserInfoonBackToCCleanerSetLicenseKeySetUserNameconfirmEnablePasterequestactivatemessagetracknameEmailSurnameCOptionsLicenseSciterCtrl: the license key couldn't be pasted - no key on the clipboardCompanyNamesetManageLicenseContextCOptionsLicenseSciterCtrl::onPasteKeyfile://ManageLicense.htmlicenseKeyfile://LicenseAlphaUserInfo.htmfile://LicenseRegistered.htmfile://LicenseKeyActivation.htmfile://LicenseUserInfo.htmStartWaitingStopWaitingLicenseKey_ManageSubscriptionsubscriptionManagementdataUpdatedexpiryDateautoExtensionlicenseTypedaysLeftAnchor Color VisitedAnchor ColorSoftware\Microsoft\Internet Explorer\Settingsstatictooltips_class32<A></A>Tahoma1REQUEST_EVENTS_WINDOW_MESSAGECOMBOBOXPrefsPrivacyShowOffers1stPartyHelp improve CCleanerPrefsPrivacyShowOffers3rdPartyShowOffers3rdPartyuntickOptions/PrivacyShowOffers1stPartytickenable automatic updates/MONITORenable new version notificationOptions/UpdatesCCleaner Smart Cleaning%s%s%s%s%s%s%sVMware Horizon ClientSoftware\Piriform\CCleanerTaskbarSetProgressStateTaskbarSetProgressValueconfig.def)(ignorecommandprogramIDError: CCleaner::DbgLogger::Log[Named Pipes] Trace: Debug: Warning: Info: [CrashSupport] Initialize Crash HandlerProgramFolderPiriform::CrashSupport::InitializeCrashHandlerDumpReportingDataFolderSetuptemp.defException occured when creating config.def file Piriform::CrashSupport::UpdateConfigFileCreate config.def file under with [common] values from Shepherd[common]Piriform::CrashSupport::CreateConfigFileCreate LOG subfolderException while creating new directory--product 90 --send dumps\|reportGet crash config from config.def fileException while checking if config folder existsException occured when writing to a config file
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey6=%LocalAppData%\Temp\|VMware_Horizon_Client*.log
Source: CCleaner64.exe, 00000005.00000003.2158517656.000002167E0E6000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2189908389.000002167E0E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4
Source: ccsetup624.exe, 00000000.00000003.1904447615.00000000034CF000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1882017847.00000000034CF000.00000004.00000020.00020000.00000000.sdmp, ccsetup624.exe, 00000000.00000003.1901960230.00000000034CF000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000003.2158517656.000002167E0E6000.00000004.00000020.00020000.00000000.sdmp, CCleaner64.exe, 00000005.00000002.2189908389.000002167E0E6000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2122297021.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000002.2199836073.0000000000A02000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2122541870.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: [VMware Horizon Client]
Source: CCleaner.exe, 0000000B.00000003.2166914335.00000000057DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: outlook.exeAmazon Music.exeAmazon Music Helper.exeApple Mobile Device ServicePNGShowActionCleanSuspendedWarningActionLauncher.exeShowEdgePreloadingWarningNoxVMSVC.exeShowNoxplayerCleanSuspendedWarningNoxVMHandle.exevideopad.exeShowVideoPadVideoEditorCleanSuspendedWarningShowPostboxCleanSuspendedWarningOpenVPNConnect.exeNox.exeShowOpenVPNConnectCleanSuspendedWarningMultiPlayerManager.exeiTopPDF.exeShowWallpaperEngineCleanSuspendedWarningShowiTopPDFCleanSuspendedWarningTeraBox.exepostbox.exeShowTeraBoxCleanSuspendedWarningrecorder.exeGoTo.exeShowIcecreamScreenRecorderCleanSuspendedWarningShowGoToMeetingCleanSuspendedWarningui32.exeBox.exeShowBoxDriveCleanSuspendedWarningBox Local Com Service.exeBox Edit.exeShowBoxEditCleanSuspendedWarningShowCalibreCleanSuspendedWarningcalibre-parallel.exeBitComet.exeShowBitCometCleanSuspendedWarningShowBlueJeansCleanSuspendedWarningBlueJeans.exeShowVNCViewerCleanSuspendedWarningvmware-view.exehorizon_client_service.exevmwetlm.exeShowVMwareHorizonClientCleanSuspendedWarningnextcloud.exeShowNextcloudDesktopClientCleanSuspendedWarningShowPlexHTPCCleanSuspendedWarningPlex HTPC.exevncviewer.exePlexScriptHost.exePlex Media Server.exeShowPlexMediaServerCleanSuspendedWarningYouCam10.exeShowCyberLinkYouCam10CleanSuspendedWarningYouCamService10.exeShowGoodSyncCleanSuspendedWarningShowCutePDFCleanSuspendedWarningCutePDFE.exeXmind.exeShowXmindCleanSuspendedWarningGoogleDriveFS.exeShowGoogleDriveCleanSuspendedWarningShowCorelPaintShopProCleanSuspendedWarningCorel PaintShop Pro.exeGoodSync.exeShoWYoutuPlayCleanSuspendedWarningYouTubePlayer.UWP.exeZoom.exeShowZoomCleanSuspendedWarningShowCodeCompareCleanSuspendedWarningccsa.exeShowMessengerCleanSuspendedWarningShowWebexCleanSuspendedWarningCiscoCollabHost.exeDouyin.exeShowDouyinCleanSuspendedWarningparfait_crash_handler.exeShowCapCutCleanSuspendedWarningShowWPSOfficeCleanSuspendedWarningwps.exeMessenger.exeLINE.exeShowClipchampCleanSuspendedWarningShowLineCleanSuspendedWarningDb.App.exeCapCut.exeShowDrawboardPDFCleanSuspendedWarningrealplay.exeresso.exeShowRealPlayerCleanSuspendedWarningShowRessoCleanSuspendedWarningClipchamp.exeOneDrive.exeFileCoAuth.exeSkype.exeShowOneDriveCleanSuspendedWarningShowSkypeCleanSuspendedWarningAppleMobileDeviceProcess.exeAppleFirefoxHost.exeiCloud.exeShowiCloudCleanSuspendedWarningShowTeamsCleanSuspendedWarningTeams.exeiCloudFirefox.exeAppleIEDAV.exeApplePhotoStreams.exeAPSDaemon.exesecd.exeiCloudCKKS.exeiCloudServices.exeiCloudPhotos.exeiCloudIE.exeiCloudDrive.exeMicrosoft.Photos.exeShowDiscordCleanSuspendedWarningShowMicrosoftPhotosCleanSuspendedWarningMicrosoft.Notes.exeiCloudPrefs.exeShowMicrosoftStickyNotesCleanSuspendedWarningTelegram.exeAcrobat.exeShowTelegramCleanSuspendedWarningShowAdobeAcrobatReaderCleanSuspendedWarningDiscord.exeShowWhatsAppCleanSuspendedWarningTodo.exeDolbyAccess.exeShowMicrosoftToDoCleanSuspendedWarningShowDolbyAccessCleanSuspendedWarningShowAmazonMusicCleanSuspendedWarningAmazon Music.exeiTunes.exeAppleMobileDeviceSe
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Horizon View Client
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey6=%ProgramFiles%\VMware\VMware Workstation\ico\|*.ico
Source: CCUpdate.exe, 00000007.00000002.2199836073.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2122541870.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, CCUpdate.exe, 00000007.00000003.2140983729.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: videopad.exeNoxVMHandle.exeRECURSEREMOVESELFActionLauncher.exeNox.exeOpenVPNConnect.exeNoxVMSVC.exeMultiPlayerManager.exeBitComet.execalibre-parallel.exeBox.exeBlueJeans.exehorizon_client_service.exevncviewer.exevmwetlm.exevmware-view.exeiTopPDF.exeui32.exepostbox.exeTeraBox.exeBox Local Com Service.exeBox Edit.exeGoTo.exerecorder.exeGoogleDriveFS.execcsa.exeGoodSync.exeCorel PaintShop Pro.exeDouyin.exeCiscoCollabHost.exeZoom.exeYouTubePlayer.UWP.exeYouCamService10.exeYouCam10.exePlex HTPC.exenextcloud.exeXmind.exeCutePDFE.exePlexScriptHost.exePlex Media Server.exeFileCoAuth.exeOneDrive.exerealplay.exeSkype.exeAppleMobileDeviceProcess.exeAppleFirefoxHost.exeTeams.exeiCloud.exeparfait_crash_handler.exeCapCut.exeMessenger.exewps.exeClipchamp.exeresso.exeDb.App.exeLINE.exeiCloudPrefs.exeMicrosoft.Notes.exeiCloudServices.exeiCloudCKKS.exeAcrobat.exeTelegram.exeMicrosoft.Photos.exeDiscord.exeAppleIEDAV.exeApplePhotoStreams.exesecd.exeAPSDaemon.exeiCloudPhotos.exeiCloudIE.exeiCloudFirefox.exeiCloudDrive.exeslack.exeTodo.exeWhatsApp.exeprimevideo.exeDolbyAccess.exeAmazon Music Helper.exeAmazon Music.exeAppleMobileDeviceService.exeiTunes.exea3yn
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey3=%ProgramData%\VMware\VDM\logs\|.
Source: CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: ShowEdgePreloadingWarningShowActionCleanSuspendedWarningNoxVMSVC.exeNoxVMHandle.exeNox.exeMultiPlayerManager.exeShowVideoPadVideoEditorCleanSuspendedWarningActionLauncher.exeShowNoxplayerCleanSuspendedWarningvideopad.exeTeraBox.exeShowTeraBoxCleanSuspendedWarningiTopPDF.exeShowiTopPDFCleanSuspendedWarningOpenVPNConnect.exeShowOpenVPNConnectCleanSuspendedWarningpostbox.exeShowPostboxCleanSuspendedWarningrecorder.exeShowIcecreamScreenRecorderCleanSuspendedWarningBox Local Com Service.exeShowBoxEditCleanSuspendedWarningui32.exeShowWallpaperEngineCleanSuspendedWarningGoTo.exeShowGoToMeetingCleanSuspendedWarningShowBitCometCleanSuspendedWarningBlueJeans.exeShowCalibreCleanSuspendedWarningBitComet.exeShowBoxDriveCleanSuspendedWarningBox Edit.exeShowBlueJeansCleanSuspendedWarningBox.exeShowVNCViewerCleanSuspendedWarninghorizon_client_service.exeShowPlexHTPCCleanSuspendedWarningvncviewer.exeShowVMwareHorizonClientCleanSuspendedWarningcalibre-parallel.exevmware-view.exevmwetlm.exeYouCam10.exeYouCamService10.exePlexScriptHost.exeShowPlexMediaServerCleanSuspendedWarningShowNextcloudDesktopClientCleanSuspendedWarningPlex HTPC.exeShowCyberLinkYouCam10CleanSuspendedWarningnextcloud.exeShowGoodSyncCleanSuspendedWarningCutePDFE.exeShowCorelPaintShopProCleanSuspendedWarningGoodSync.exeShowXmindCleanSuspendedWarningPlex Media Server.exeShowCutePDFCleanSuspendedWarningXmind.exeZoom.exeShowZoomCleanSuspendedWarningYouTubePlayer.UWP.exeShoWYoutuPlayCleanSuspendedWarningShowGoogleDriveCleanSuspendedWarningCorel PaintShop Pro.execcsa.exeShowCodeCompareCleanSuspendedWarningMessenger.exeShowMessengerCleanSuspendedWarningwps.exeShowWPSOfficeCleanSuspendedWarningDouyin.exeShowDouyinCleanSuspendedWarningCiscoCollabHost.exeShowWebexCleanSuspendedWarningShowLineCleanSuspendedWarningDb.App.exeShowClipchampCleanSuspendedWarningLINE.exeparfait_crash_handler.exeShowCapCutCleanSuspendedWarningShowDrawboardPDFCleanSuspendedWarningCapCut.exeShowSkypeCleanSuspendedWarningrealplay.exeShowOneDriveCleanSuspendedWarningShowRessoCleanSuspendedWarningClipchamp.exeShowRealPlayerCleanSuspendedWarningresso.exeAppleMobileDeviceProcess.exeiCloud.exesecd.exeAppleFirefoxHost.exeShowTeamsCleanSuspendedWarningShowiCloudCleanSuspendedWarningTeams.exeiCloudPhotos.exeiCloudDrive.exeiCloudServices.exeiCloudIE.exeAppleIEDAV.exeAPSDaemon.exeiCloudFirefox.exeApplePhotoStreams.exeMicrosoft.Photos.exeShowMicrosoftPhotosCleanSuspendedWarningDiscord.exeShowDiscordCleanSuspendedWarningiCloudPrefs.exeiCloudCKKS.exeMicrosoft.Notes.exeShowMicrosoftStickyNotesCleanSuspendedWarningDolbyAccess.exeShowDolbyAccessCleanSuspendedWarningShowWhatsAppCleanSuspendedWarningShowMicrosoftToDoCleanSuspendedWarningAcrobat.exeShowAdobeAcrobatReaderCleanSuspendedWarningTelegram.exeShowTelegramCleanSuspendedWarningShowAmazonPrimeCleanSuspendedWarningShowSlackCleanSuspendedWarningShowItunesCleanSuspendedWarningShowAmazonMusicCleanSuspendedWarningShowAVGBrowserCleanSuspendedWarningShowNortonBrowserCleanSuspendedWarningShowOperaGXClea
Source: CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: license-typelicense-devicesaff-idjava se development kitpython%02d%d%den-wwmicrosoft r clientmicrosoft azurewinscpxamarinmysql connector c++visual c++ for mobile developmentcronosbkchemInternet SecurityTotal SecurityFull8install-timeflagsAntivirus FreeAntivirus Plusis-triallicense-remaining-dayslicense-total-daysexpiration-timeproduct-codeverboseis-freeis-expiredmodellussongsmithversion imagenscilabeqtablaalice applicationpilas-enginefusioninventoryprerequisites for ssdtmysqlgit versionjetbrainsunitywinpcapandroid studionode.jstrafico de faunacmakedev-c++microsoft visual c++ build toolskokorie-readergnu privacy guardmm7270khi3forcepadlabcamginga.aravidemuxgapmindermicrosoft emulatormaximavmwaremicrosoft sql server management studioiis express application compatibility database*iis expresswindows software development kitmicrosoft sql server * management objects*microsoft .net framework multi-targeting packmicrosoft system clr types for sql servermicrosoft visual studio * shell*microsoft sql server express localdb*microsoft sql server transact-sql scriptdomnotepad++pgadminpostgresputty**intel
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey2=%ProgramData%\VMware\VDM\logs\|.
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: [VMware Player]
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Player
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\VMware\VMware Workstation
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: [VMware Workstation]
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey4=%LocalAppData%\VMware\VDM\logs\|.
Source: CCleaner64.exe, 00000005.00000002.2189908389.000002167E0E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ccsetup624.exe, 00000000.00000003.1927160059.0000000005E90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ZeqHGFSQN=HME31
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey4=%LocalAppData%\Temp\vmware-\|.*
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: Application StartedCCleaner Username: /debugCApplication::ParseCommandlineArguments/scheduling/export/monitoring/advanced/registry/options/cleaner/tools( [k\|K][e\|E][y\|Y]=+?"{[^"]+})/unregister/register( [n\|N][a\|A][m\|M][e\|E]=+?"{[^"]+})/scanreg/createskipuac/ccinfo/ccupdate/issuesPiriformRegistration/restoreccb/du /[l\|L][i\|I][s\|S][t\|T] +"?{[^"]+})/restoreccb/sysrestore(/[s\|S][y\|Y][s\|S][r\|R][e\|E][s\|S][t\|T][o\|O][r\|R][e\|E] +{[0-9]+})AutoUpdatesSmartCleanActivationUpdateNotificationsonoffNumOfUpToDateDriversNumOfIssueDetectedDriversDetectioncc6 researchIsElevatedwebview2 :: SkipUACIsAdminSmartClean:JunkAlertsSmartClean:BrowserAlertsGamerScoreGamerScoreVersiongui openStartupccleaner startup eventmonitoringcc6 research - DetectionLikelyVirtualMachineUninstall.lnkShowTrialDiscountOffer/OPTIONSuninst.exe/REGISTRY/TOOLS/AUTOJL/CLEANERNoCCREGISTERED={}
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey5=%LocalAppData%\Temp\vmware-\|.*
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey5=%ProgramFiles%\Common Files\VMware\InstallerCache\|.
Source: CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: Piriform::CrashSupport::UpdateConfigFile[CrashSupport] --silentPiriform::CrashSupport::CrashReportParameters[CrashSupport] \CCleanerBugReport.exe Piriform::CrashSupport::UpdateCrashReportingTaskStatus[CrashSupport] /\--product 90 --send dumps\|report --path " --programpath " --guid " --version " disabled crash reporting scheduled task - error when saving: Piriform::CrashSupport::UpdateCrashReportingTaskStatus[CrashSupport] Failed to enabled disabledCrash Reporting scheduled task enableddisabledPiriform::CrashSupport::UpdateCrashReportingTaskStatus[CrashSupport] Failed to enabled crash reporting scheduled task - error when loading Piriform::CrashSupport::UpdateCrashReportingTaskStatus[CrashSupport] Add crash reporting scheduled task which runs dailyWinUnknownWin2KWinXPWinVistaWin7SOHOnansnssnsdnspnseeavWin8Win8.1Win10FreeProISPremierBusinesskavkiskfapurekesksospcksosfswkseavbeessbeeeaesseeseisesspefswUnknownCommercialBetaTrialTestOEMSubscriptionSubscriptionProtectionkavkiskfapurekesksospcksosfswksASUSHPInfinitumLenovoLenovo ThinkDellDellDellFreeValidLicenseGracePeriodDowngradeExpiredLicensePauseBlockedLicenseStandaloneThird WaveMcAfee StoreIntel PricebookPartnerResellerAffiliatecis.av.freecis.av.advToshibaAT&TTelefonica ColombiaAdobeMedionACERBTStaples Techbenchcis.sb.freeMBAM-CMBAM-BNCEP_WINMBRW_CMBRW_Bunknownfreecis.fw.freecis.fw.advcis.premium.freecis.pluscis.procis.completecis.endpointcis.cas.endpointF16A9578-E0E4-4EA7-8FD7-E91C0061A9FD78E68749-DE5B-404A-9B44-7A5AEDED1CFC7F4CCD0B-B3BE-4FD2-9A26-A0299FDE418BA435FAA9-2311-4E23-B944-096D54E9DB31CApplication::~CApplicationtrialtrialExpiredlicensedlicenseExpiredlicenseGrace\F9FD4EDF-1129-4DBC-9A8C-9EE7271FBE7E4141FCD7-B506-4916-8EC4-D38E4373F47Aopentarget_main\|,\|Application Ended#32770Scripting()/autojl/autosScripting()/autos/autosc/monitoropen/autorbRecycleBinRun CCleanerclick/autojl/restartScripting/restart/autoScripting()/auto/deleteScripting()/autosc/auto/shutdownScripting/shutdown/auto()/delete/updateScripting()/update/clean/shutdown/method/method %dScripting/deleteScripting/method/deleteScripting()/clean/analyzeScripting()/analyze/frbRecycleBinScripting/shutdown/clean/restartScripting/restart/cleanScriptingCloud PC EnterpriseMicrosoft CorporationGoogle Compute EngineGoogleParallels ARM Virtual MachineParallels International GmbH.Parallels Virtual PlatformParallels Software International Inc.Open CCleanerclickVirtualBoxinnotek GmbHVirtual MachineMicrosoft CorporationBaidu Cloud BCCBaidu CloudAmazon EC2VMware, Inc.Tencent CloudUpCloudThinCloudQuanta Cloud Technology Inc.Parallels ARM Virtual MachineParallelsQEMU Virtual MachineQEMUVirtual serverCOOLHOUSING s.r.o.Alibaba Cloud ECSAlibaba CloudVirtual serverVirtual Server/uac/uac/updatesuccess/updatefailed/updatesuccessVirtuozzoVultrSystemManufacturerSystemProductNameVirtual PlatformVirtual Machine/autosc/shutdown/restart/autorb/autojl/autosc/debug /updateopen/auto/autorb/autojl/autosCApplication::ParseCommandlineArgumentsCApplication::Parse
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile2=%ProgramFiles%\VMware\VMware Workstation
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey3=%LocalAppData%\Temp\vmware-\|.*
Source: CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: license-typelicense-devicesaff-idmm7270trafico de faunacmakedev-c++ginga.arkokorie-readergnu privacy guardbkchemmicrosoft r clientmicrosoft azurewinscpmicrosoft visual c++ build toolsmysql connector c++visual c++ for mobile developmentcronosfusioninventorymodellussongsmithversion imagenjetbrainseqtablaalice applicationpilas-enginemaximakhi3forcepadlabcamscilabavidemuxgapmindermicrosoft emulatornetbeansarduinoblenderatomoracleslacksourcetreegithubnode.jsprerequisites for ssdtmysqlgit versionxamppunitywinpcapandroid studiomicrosoft system clr types for sql servervmwaremicrosoft sql server management studioiis express application compatibility databasenotepad++windows software development kit*microsoft sql server management objects*microsoft .net framework multi-targeting packapache tomcatsdkxmingvagrant*iis expresstortoisesvnsublime text*glassfishvsomqsmpfDisplayNameInstallTStmpActivateTimeSOFTWARE\McAfee\MSCvul*intel
Source: CCleaner64.exe, 00000005.00000002.2195440622.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: LikelyVirtualMachine
Source: CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: VMware Horizon Client
Source: CCleaner64.exe, 00000005.00000000.2106162645.00007FF7C217B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: \CCleanerBugReport.exe Piriform::CrashSupport::UpdateCrashReportingTaskStatus --silentPiriform::CrashSupport::CrashReportParameters --guid " --version " --path " --programpath " crash reporting scheduled task - error when saving: crash reporting scheduled task - error when loading enabled disableddisabledFailed to Crash Reporting scheduled task enabledAdd crash reporting scheduled task which runs daily7F4CCD0B-B3BE-4FD2-9A26-A0299FDE418BA435FAA9-2311-4E23-B944-096D54E9DB31F16A9578-E0E4-4EA7-8FD7-E91C0061A9FD78E68749-DE5B-404A-9B44-7A5AEDED1CFCF9FD4EDF-1129-4DBC-9A8C-9EE7271FBE7E4141FCD7-B506-4916-8EC4-D38E4373F47A/monitor/autorbBroken CountPrevious CountApplication EndedError typeCApplication::~CApplication/autos/autosc/autojl/autosScripting()Run CCleaner/autojl/restart/delete/auto/restart/shutdown/shutdown/autosc/auto/clean/clean/update/update/delete/method/method/method %dinnotek GmbHVirtual MachineSYSTEM\CurrentControlSet\Control\SystemInformationVirtualBox/frbOpen CCleaner/analyze/analyzeParallels Virtual PlatformParallels Software International Inc.Parallels ARM Virtual MachineParallels International GmbH.Google Compute EngineGoogleMicrosoft CorporationCloud PC EnterpriseAlibaba CloudBaidu Cloud BCCCOOLHOUSING s.r.o.Alibaba Cloud ECSQEMUVirtual serverParallelsQEMU Virtual MachineQuanta Cloud Technology Inc.VirtuozzoUpCloudThinCloudVMware, Inc.Tencent CloudBaidu CloudAmazon EC2/updatesuccess/updatefailedVirtual Server/uacSystemProductNameVirtual PlatformVultrSystemManufacturer/cleanie/log
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey1=%ProgramData%\VMware\logs\|.
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: VMware Player
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey3=%ProgramData%\VMware\vmwetlm\logs\|.
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: VMware Workstation
Source: CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: FileKey2=%Program Files%\VMware\VMware Player\ico\|.
Source: CCleaner.exe, 0000000B.00000002.2175933437.00000000022F0000.00000002.00000001.01000000.00000019.sdmp, CCleaner.exe, 0000000B.00000000.2133065383.00000000022F0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: /ccinfo/ccinfo"/update/clean/analyze/monitoring/advanced/scheduling/export/export""/register( [n\|N][a\|A][m\|M][e\|E]=+?"{[^"]+})( [k\|K][e\|E][y\|Y]=+?"{[^"]+})0/unregister0/clean/shutdown/restart/ccupdate/scanreg/createskipuac/createskipuac/restoreccb/du/issuesPiriformRegistration/MONITOR11NumOfUpToDateDrivers/monitor/sysrestore0(/[s\|S][y\|Y][s\|S][r\|R][e\|E][s\|S][t\|T][o\|O][r\|R][e\|E] +{[0-9]+}) /[l\|L][i\|I][s\|S][t\|T] +"?{[^"]+})/restoreccbScripting()onoffActivationAutoUpdatesAutoUpdatesonoffActivationNumOfIssueDetectedDriversonoffActivationUpdateNotificationsUpdateNotificationsoffActivationSmartClean:BrowserAlertsSmartClean:BrowserAlertsonoffActivationSkipUACSmartCleanSmartCleanonoffActivationSmartClean:JunkAlertsSmartClean:JunkAlertsonDetectioncc6 researchcc6 research - DetectionLikelyVirtualMachinetruefalseccleaner startup eventmonitoringSkipUAConoffIsAdminonoffIsElevatedwebview2 :: /AUTOJL&/CLEANER&gui openStartup100GamerScoreGamerScoreVersion/OPTIONS;;uninst.exeUninstall.lnk0/MONITOR/REGISTRY&/TOOLS&/update3.19.3.18.1708110CCInfo.txtCCVERSION={}

Source: C:\Users\user\Desktop\ccsetup624.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process queried: DebugPort

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_002734FC IsDebuggerPresent,OutputDebugStringW,

7_2_002734FC

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Program Files\CCleaner\CCUpdate.exe

7_2_0023DF0A

Contains functionality to dynamically determine API calls

Source: C:\Program Files\CCleaner\CCUpdate.exe

7_2_0023BA23

Contains functionality to read the PEB

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0028D198 mov ecx, dword ptr fs:[00000030h]	7_2_0028D198
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0029231B mov eax, dword ptr fs:[00000030h]	7_2_0029231B
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_0029235F mov eax, dword ptr fs:[00000030h]	7_2_0029235F

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0029805F GetProcessHeap,

7_2_0029805F

Enables debug privileges

Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleanerBugReport.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Process token adjusted: Debug
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Process token adjusted: Debug

Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_002740FF SetUnhandledExceptionFilter,	7_2_002740FF
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00278533 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00278533
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00273AA6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00273AA6
Source: C:\Program Files\CCleaner\CCUpdate.exe	Code function: 7_2_00273F6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00273F6C

Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe" /reg	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCUpdate.exe "C:\Program Files\CCleaner\CCUpdate.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe"	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Process created: C:\Program Files\CCleaner\CCleaner64.exe "C:\Program Files\CCleaner\CCleaner64.exe" /monitor
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 6472 -ip 6472
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6472 -s 8068

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0023E545 __EH_prolog3,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

7_2_0023E545

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0023FC7B GetCurrentProcess,OpenProcessToken,AllocateAndInitializeSid,GetTokenInformation,EqualSid,FreeSid,FindCloseChangeNotification,

7_2_0023FC7B

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0025F380 cpuid

7_2_0025F380

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\Desktop\ccsetup624.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files\CCleaner\CCleaner64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\CC_logo_72x66.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\CC_Logo_40x96.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nslD8B3.tmp\ui\res\PF_computer.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ccsetup624.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_controller.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_telemetry.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_telemetry.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_telemetry.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_controller.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_adapter.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\DriverUpdaterLib.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\DriverUpdEng.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\DriverUpdEngTask.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_telemetry.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_telemetry.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Program Files\CCleaner\LOG\su_controller.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformation
Source: C:\Program Files\CCleaner\CCleaner64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	Queries volume information: C:\Program Files\CCleaner\LOG\event_manager.log VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files\CCleaner\wa_3rd_party_host_32.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_0024457D __EH_prolog3_GS_align,VariantInit,SysFreeString,SysFreeString,GetModuleFileNameW,GetSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,VariantClear,VariantClear,

7_2_0024457D

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_00292B19 GetTimeZoneInformation,

7_2_00292B19

Source: C:\Program Files\CCleaner\CCUpdate.exe

Code function: 7_2_002623C0 GetVersion,GetModuleHandleW,GetProcAddress,GetSystemFirmwareTable,GetSystemFirmwareTable,GetModuleHandleW,GetProcAddress,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,

7_2_002623C0

Source: C:\Users\user\Desktop\ccsetup624.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables Windows system restore

Source: C:\Program Files\CCleaner\CCleaner64.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore SystemRestorePointCreationFrequency

AV process strings found (often used to terminate AV products)

Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C2D7D000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2C8E000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile1=%ProgramFiles%\Malwarebytes' Anti-Malware\mbam.exe
Source: CCleaner64.exe, 00000005.00000000.2108678442.00007FF7C2D7D000.00000002.00000001.01000000.00000016.sdmp, CCleaner64.exe, 00000005.00000002.2202976426.00007FF7C2C8E000.00000002.00000001.01000000.00000016.sdmp, CCleaner.exe, 0000000B.00000002.2183327476.0000000002C38000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: DetectFile2=%ProgramFiles%\Malwarebytes Anti-Malware\mbam.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiVirusProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpywareProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiVirusProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpywareProduct
Source: C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000002.dbtmp
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files\CCleaner\CCleaner64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Inhibit System Recovery
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	12 Windows Service	11 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	67 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	12 Windows Service	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	11 Process Injection	13 Masquerading	LSA Secrets	1101 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Bootkit	2 Scheduled Task/Job	1 Valid Accounts	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	181 Virtualization/Sandbox Evasion	DCSync	181 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ccsetup624.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
ccsetup624.exe