File name:

PatchCleaner_1.4.2.0.exe

Full analysis: https://app.any.run/tasks/1801cf2c-f0b6-4d7b-8f68-264782f8dbb9
Verdict: Malicious activity
Threats:

Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription and costs $200 per month. Raccoon malware has already infected over 100,000 devices and became one of the most mentioned viruses on the underground forums in 2019.

Malware Trends Tracker     >>>
Analysis date: March 19, 2024, 13:16:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
raccoon
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

70D0BD7633D10C492839272C97B2544E

SHA1:

4DA0E8C2FE1F06B13985D700FE15686A1015C3BB

SHA256:

6472DE894C5CB6050FD80CDD893B8772AEF71F8BDB5C65A0175CF7CBB90E6EC6

SSDEEP:

49152:/hUhnNLygNCtZ7TbDQ/ukd5A7N3dIYjZXZceR9pv+MLwUUWOrud3u8QhEDsy/0JC:/hUhnN2ZtGuqA7NNVZp1+MLVYKd3xsEx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • PatchCleaner_1.4.2.0.exe (PID: 2408)

    • Raccoon mutex has been detected

      • PatchCleaner.exe (PID: 3192)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • PatchCleaner_1.4.2.0.exe (PID: 2408)

    • Executable content was dropped or overwritten

      • PatchCleaner_1.4.2.0.exe (PID: 2408)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 1824)
      • PatchCleaner.exe (PID: 3192)

    • Reads the Internet Settings

      • setup.exe (PID: 1824)
      • PatchCleaner.exe (PID: 3192)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 696)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2644)

    • Non-standard symbols in registry

      • WINWORD.EXE (PID: 2992)

    • The process executes VB scripts

      • PatchCleaner.exe (PID: 3192)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 268)
      • cscript.exe (PID: 2380)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 268)
      • cscript.exe (PID: 2380)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 268)
      • cscript.exe (PID: 2380)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 2380)
      • cscript.exe (PID: 268)

  • INFO

    • Checks supported languages

      • PatchCleaner_1.4.2.0.exe (PID: 2408)
      • setup.exe (PID: 1824)
      • wmpnscfg.exe (PID: 3036)
      • PatchCleaner.exe (PID: 3192)

    • Create files in a temporary directory

      • PatchCleaner_1.4.2.0.exe (PID: 2408)
      • setup.exe (PID: 1824)
      • PatchCleaner.exe (PID: 3192)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1824)
      • PatchCleaner.exe (PID: 3192)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 696)
      • cscript.exe (PID: 268)
      • cscript.exe (PID: 2380)

    • Reads the software policy settings

      • msiexec.exe (PID: 696)

    • Reads the computer name

      • setup.exe (PID: 1824)
      • wmpnscfg.exe (PID: 3036)
      • PatchCleaner.exe (PID: 3192)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 696)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 696)

    • Manual execution by a user

      • WINWORD.EXE (PID: 2992)
      • PatchCleaner.exe (PID: 3192)
      • PatchCleaner.exe (PID: 2344)
      • wmpnscfg.exe (PID: 3036)

    • Creates files in the program directory

      • PatchCleaner.exe (PID: 3192)
      • cscript.exe (PID: 268)
      • cscript.exe (PID: 2380)

    • Creates files or folders in the user directory

      • PatchCleaner.exe (PID: 3192)

    • Reads Environment values

      • PatchCleaner.exe (PID: 3192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 16:27:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 104960
InitializedDataSize: 45056
UninitializedDataSize: -
EntryPoint: 0x14b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.20.0.0
ProductVersionNumber: 9.20.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.2
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFileName: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
12
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start patchcleaner_1.4.2.0.exe setup.exe no specs msiexec.exe vssvc.exe no specs winword.exe no specs wmpnscfg.exe no specs patchcleaner.exe no specs patchcleaner.exe cscript.exe no specs cscript.exe no specs PhotoViewer.dll no specs patchcleaner_1.4.2.0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Windows\System32\cscript.exe" //B //Nologo WMIProducts.vbsC:\Windows\System32\cscript.exe—PatchCleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
696"C:\Windows\system32\msiexec.exe" -I "C:\Users\admin\AppData\Local\Temp\7zS6D3C.tmp\PatchCleaner.msi" C:\Windows\System32\msiexec.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1824.\setup.exeC:\Users\admin\AppData\Local\Temp\7zS6D3C.tmp\setup.exe—PatchCleaner_1.4.2.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
14.0.23107.0 built by: D14REL
Modules
Images
c:\users\admin\appdata\local\temp\7zs6d3c.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2344"C:\Program Files\HomeDev\PatchCleaner\PatchCleaner.exe" C:\Program Files\HomeDev\PatchCleaner\PatchCleaner.exe—explorer.exe
User:
admin
Company:
HomeDev
Integrity Level:
MEDIUM
Description:
PatchCleaner
Exit code:
3221226540
Version:
1.4.2.0
Modules
Images
c:\program files\homedev\patchcleaner\patchcleaner.exe
c:\windows\system32\ntdll.dll
2380"C:\Windows\System32\cscript.exe" //B //Nologo WMIProducts.vbsC:\Windows\System32\cscript.exe—PatchCleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2408"C:\Users\admin\AppData\Local\Temp\PatchCleaner_1.4.2.0.exe" C:\Users\admin\AppData\Local\Temp\PatchCleaner_1.4.2.0.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Exit code:
0
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\patchcleaner_1.4.2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2644C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2992"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\independentjuly.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3036"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3192"C:\Program Files\HomeDev\PatchCleaner\PatchCleaner.exe" C:\Program Files\HomeDev\PatchCleaner\PatchCleaner.exe
explorer.exe
User:
admin
Company:
HomeDev
Integrity Level:
HIGH
Description:
PatchCleaner
Exit code:
0
Version:
1.4.2.0
Modules
Images
c:\program files\homedev\patchcleaner\patchcleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
18 606
Read events
17 906
Write events
382
Delete events
318

Modification events

(PID) Process:(1824) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1824) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1824) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1824) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(696) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2644) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000001E5C8AB4FF79DA01540A000048050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
6
Text files
9
Unknown types
2

Dropped files

PID
Process
Filename
Type
2992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRD472.tmp.cvr —
MD5:—
SHA256:—
696msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI724E.tmpexecutable
MD5:79A1DC3E058699630F44EAEF8736D637
SHA256:ADF737E044C8125286B7F0C2907597D840CA6F3DC92E8CB56A5BC20243C723D4
2408PatchCleaner_1.4.2.0.exeC:\Users\admin\AppData\Local\Temp\7zS6D3C.tmp\PatchCleaner.msiexecutable
MD5:CA19DC264E480DB621D11429E08CA62B
SHA256:C43F57C1AFF7A3571FB89A6467247417BDF5B5AE2CD3AB60CE444490BC4DF164
2992WINWORD.EXEC:\Users\admin\Desktop\~$dependentjuly.rtfbinary
MD5:07EF56F13CFC70F5B902A6FB4A38BCE1
SHA256:196D50D3A6CE27FE9C3C5B1FAD7F87D4CB602F19071B3A7877FD45DFE21C660A
2992WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\independentjuly.rtf.LNKlnk
MD5:0AAEE3CB435C2A9B30E51DE93BA79BF2
SHA256:5A603BFA2D24536D70E36FEE9CBA1F52F7C4915C81D31EF51BEA91928A96ADD3
3192PatchCleaner.exeC:\Users\admin\AppData\Local\HomeDev\PatchCleaner.exe_Url_dgtqfentktrphev14fflfkuaslqzfwxf\1.4.2.0\konn4duw.newcfgxml
MD5:471A89B7EB58CA4E703F456DA01A9F31
SHA256:6E76F167E24B7E02386E79794015A5FEDB5EFE9AB5D25C60C6FE0A6F0013A048
2992WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{318DD648-F7C8-4FFF-9DE5-52CF95C0F7A6}.tmpsmt
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
2992WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{C6ABC91F-669B-415E-99C1-BF6A08CC3A37}.tmpbinary
MD5:1C434A840DC0EF003594EEC43836C428
SHA256:3705E7F2AFCC1506ABD3B1CDF7FCC23C2892075CC8087B90C3857EB1E0EB6FAD
2992WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{607DE995-C3C0-48A0-92DE-C63FF5ADDD3F}.tmpdbf
MD5:CE06ED1E89D91AA85DC166430992708D
SHA256:F5EA64BF95CFA223FF930F3FF6E136D2BA8001BE725074856F639FB3F03FB9E4
1824setup.exeC:\Users\admin\AppData\Local\Temp\VSD6F9D.tmp\install.logbinary
MD5:6761D3DB34A56EF5C650344EB6B1F337
SHA256:BC3F43FD3AC15C39785DA22176EB26A04CD30D4B9F2B65FDD6CABCE00E843745
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
PatchCleaner.exe
GET
301
107.191.57.177:80
http://www.homedev.com.au/Common/CurrentVersion/727da176-50bb-452c-8db5-96ee0a573ed4
unknown
html
208 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3192
PatchCleaner.exe
107.191.57.177:80
www.homedev.com.au
AS-CHOOPA
US
unknown
3192
PatchCleaner.exe
107.191.57.177:443
www.homedev.com.au
AS-CHOOPA
US
unknown

DNS requests

Domain
IP
Reputation
www.homedev.com.au
  • 107.191.57.177
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PatchCleaner_1.4.2.0.exe