File name:

Windows Defender SmartScreen.exe

Full analysis: https://app.any.run/tasks/6ff1d8e8-e3d9-4bb1-bfe1-0cd01bc75eff
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 15, 2024, 21:18:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

88C7712A0D38ED6B42EBF2A494E6BCCB

SHA1:

F31AA6B70D7BB73EF3B5A13B6EF893BD9B8B784F

SHA256:

86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385

SSDEEP:

768:R8sPClzhaxRQsVDtcka1rqunKWaHGk3rSaowC7c1iajVQNPl1Rz4Rk3OsOdMTcBq:RJ8atcd12GaHZOgC7kuZl1dDySTcP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1424)

    • Create files in the Startup directory

      • Windows Defender SmartScreen.exe (PID: 2040)

    • NJRAT has been detected (SURICATA)

      • svchost.exe (PID: 1040)

    • Connects to the CnC server

      • svchost.exe (PID: 1040)

    • NJRAT has been detected (YARA)

      • svchost.exe (PID: 1040)

    • Steals credentials from Web Browsers

      • CCleaner.exe (PID: 1424)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 1424)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Windows Defender SmartScreen.exe (PID: 2040)
      • CCleaner.exe (PID: 1424)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)

    • Executable content was dropped or overwritten

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1424)

    • Starts itself from another location

      • Windows Defender SmartScreen.exe (PID: 2040)

    • The process creates files with name similar to system file names

      • Windows Defender SmartScreen.exe (PID: 2040)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)

    • Connects to unusual port

      • svchost.exe (PID: 1040)

    • The process executes via Task Scheduler

      • CCleaner.exe (PID: 1424)
      • StUpdate.exe (PID: 2544)
      • StUpdate.exe (PID: 948)

    • Checks Windows Trust Settings

      • CCleaner.exe (PID: 1424)

    • Searches for installed software

      • CCleaner.exe (PID: 1424)

    • Reads security settings of Internet Explorer

      • CCleaner.exe (PID: 1424)

    • Reads settings of System Certificates

      • CCleaner.exe (PID: 1424)

    • Reads Internet Explorer settings

      • CCleaner.exe (PID: 1424)

  • INFO

    • Reads the computer name

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1984)
      • CCleaner.exe (PID: 1424)
      • StUpdate.exe (PID: 948)

    • Checks supported languages

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1984)
      • CCleaner.exe (PID: 1424)
      • StUpdate.exe (PID: 948)

    • Creates files or folders in the user directory

      • Windows Defender SmartScreen.exe (PID: 2040)
      • CCleaner.exe (PID: 1424)

    • Reads the machine GUID from the registry

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1424)
      • StUpdate.exe (PID: 948)

    • Create files in a temporary directory

      • Windows Defender SmartScreen.exe (PID: 2040)
      • svchost.exe (PID: 1040)
      • StUpdate.exe (PID: 948)

    • Reads Environment values

      • svchost.exe (PID: 1040)
      • CCleaner.exe (PID: 1424)
      • CCleaner.exe (PID: 1984)

    • Manual execution by a user

      • CCleaner.exe (PID: 1984)

    • Creates files in the program directory

      • CCleaner.exe (PID: 1424)

    • Checks proxy server information

      • CCleaner.exe (PID: 1424)

    • Reads CPU info

      • CCleaner.exe (PID: 1424)

    • Reads product name

      • CCleaner.exe (PID: 1424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1040) svchost.exe
C2147.185.221.18
Ports2231
BotnetRuntime Broker
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\1ad780d6208f0ac304ffc9eb3bbab2f4
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:15 22:14:54+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 94208
InitializedDataSize: 512
UninitializedDataSize: -
EntryPoint: 0x18f3e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windows defender smartscreen.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs #NJRAT svchost.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs schtasks.exe no specs ccleaner.exe no specs ccleaner.exe stupdate.exe no specs stupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
948C:\Users\admin\AppData\Local\Temp/StUpdate.exe C:\Users\admin\AppData\Local\Temp\StUpdate.exe
taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1040"C:\Users\admin\AppData\Roaming\Microsoft\svchost.exe" C:\Users\admin\AppData\Roaming\Microsoft\svchost.exe
Windows Defender SmartScreen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1040) svchost.exe
C2147.185.221.18
Ports2231
BotnetRuntime Broker
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\1ad780d6208f0ac304ffc9eb3bbab2f4
Splitter|'|'|
Version0.7d
1288netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Windows Defender SmartScreen.exe" "Windows Defender SmartScreen.exe" ENABLEC:\Windows\System32\netsh.exe—Windows Defender SmartScreen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1424"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
6.14.0.10584
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
1560schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\admin\AppData\Local\Temp/StUpdate.exeC:\Windows\System32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1792netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLEC:\Windows\System32\netsh.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1984"C:\Program Files\CCleaner\CCleaner.exe" C:\Program Files\CCleaner\CCleaner.exe—explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
6.14.0.10584
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
2020netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Windows Defender SmartScreen.exe" "Windows Defender SmartScreen.exe" ENABLEC:\Windows\System32\netsh.exe—Windows Defender SmartScreen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2040"C:\Users\admin\AppData\Local\Temp\Windows Defender SmartScreen.exe" C:\Users\admin\AppData\Local\Temp\Windows Defender SmartScreen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\windows defender smartscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2344netsh firewall delete allowedprogram "C:\Users\admin\AppData\Roaming\Microsoft\svchost.exe"C:\Windows\System32\netsh.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
17 710
Read events
17 285
Write events
375
Delete events
50

Modification events

(PID) Process:(1288) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2416) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2040) Windows Defender SmartScreen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) Windows Defender SmartScreen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) Windows Defender SmartScreen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) Windows Defender SmartScreen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2020) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1040) svchost.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
(PID) Process:(1792) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2344) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
15
Suspicious files
18
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040Windows Defender SmartScreen.exeC:\Users\admin\Desktop\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\Favorites\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\Documents\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\AppData\Roaming\Microsoft\svchost.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
2040Windows Defender SmartScreen.exeC:\Users\admin\AppData\Local\Explower.exeexecutable
MD5:88C7712A0D38ED6B42EBF2A494E6BCCB
SHA256:86FE7656A3C93637B9A63CBBA5B7A12CBE1D9673D67A1C46FFF3E3EA0D724385
1424CCleaner.exeC:\Program Files\CCleaner\gcapi_dll.dllexecutable
MD5:F637D5D3C3A60FDDB5DD397556FE9B1D
SHA256:641B843CB6EE7538EC267212694C9EF0616B9AC9AB14A0ABD7CF020678D50B02
1424CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
20
DNS requests
12
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1424
CCleaner.exe
GET
200
2.19.126.86:80
http://ncc.avast.com/ncc.txt
unknown
text
26 b
unknown
1424
CCleaner.exe
GET
200
72.247.153.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?25611a453021022b
unknown
compressed
4.66 Kb
unknown
1424
CCleaner.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
1424
CCleaner.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
unknown
1424
CCleaner.exe
GET
200
72.247.153.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f2c5879a0bb377bb
unknown
compressed
4.66 Kb
unknown
1424
CCleaner.exe
GET
200
72.247.153.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bd37ad41f78c9aa8
unknown
compressed
4.66 Kb
unknown
1424
CCleaner.exe
GET
200
72.247.153.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ef977a2a47b77f2
unknown
compressed
4.66 Kb
unknown
1424
CCleaner.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/s/gts1d4/fKYaaVX9oaM/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEFR%2BOO9BG%2B3VCUfYZJRDCnY%3D
unknown
binary
471 b
unknown
1424
CCleaner.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/s/gts1d4/t0jeL7ceLrY/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDRSW2avX2yRQo3SfbomPuF
unknown
binary
472 b
unknown
1424
CCleaner.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/s/gts1d4/ZyBjqPWqmvE/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEC2xaOeQk22TEA6Dd3CBkM0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1040
svchost.exe
147.185.221.18:2231
—
PLAYIT-GG
US
malicious
1424
CCleaner.exe
2.19.126.86:80
ncc.avast.com
Akamai International B.V.
DE
unknown
1424
CCleaner.exe
34.117.223.223:443
analytics.ff.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
1424
CCleaner.exe
34.160.176.28:443
shepherd.ff.avast.com
GOOGLE
US
unknown
1424
CCleaner.exe
34.111.24.1:443
ipm-provider.ff.avast.com
GOOGLE
US
unknown
1424
CCleaner.exe
34.149.149.62:443
ip-info.ff.avast.com
GOOGLE
US
unknown
1424
CCleaner.exe
23.35.237.21:443
www.ccleaner.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
ncc.avast.com
  • 2.19.126.86
  • 2.19.126.75
whitelisted
analytics.ff.avast.com
  • 34.117.223.223
whitelisted
shepherd.ff.avast.com
  • 34.160.176.28
whitelisted
www.ccleaner.com
  • 23.35.237.21
whitelisted
ipm-provider.ff.avast.com
  • 34.111.24.1
whitelisted
ip-info.ff.avast.com
  • 34.149.149.62
whitelisted
ctldl.windowsupdate.com
  • 72.247.153.178
  • 72.247.153.162
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
1040
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
1040
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
1040
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
1 ETPRO signatures available at the full report
Process
Message
CCleaner.exe
[2024-01-15 21:18:36.202] [error ] [settings ] [ 1424: 1572] [6000C4: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
OnLanguage - en
CCleaner.exe
[2024-01-15 21:18:37.139] [error ] [settings ] [ 1424: 2292] [9434E9: 359] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner.exe
[2024-01-15 21:18:37.155] [error ] [Burger ] [ 1424: 2292] [FDA25D: 244] [23.1.806.0] [BurgerReporter.cpp] [244] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
[2024-01-15 21:18:37.155] [error ] [Burger ] [ 1424: 2292] [FDA25D: 244] [23.1.806.0] [BurgerReporter.cpp] [244] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
OnLanguage - en
CCleaner.exe
startCheckingLicense()
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows Defender SmartScreen.exe