Malware analysis ocsp.digicert.com Malicious activity

Add for printing

File name:	ocsp.digicert.com
Full analysis:	https://app.any.run/tasks/f8700876-7ee4-4ec7-b584-1c5f1269116d
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	September 14, 2024, 18:31:01
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer evasion
Indicators:
MIME:	application/octet-stream
File info:	data
MD5:	B846B882719E09EE4996593FE9CE2FDB
SHA1:	68F64B77CAB775E1B90B563325C0BF42C60E30BF
SHA256:	BEC22A671CF77D0BEB4395ABC6CEB14A9C02822997BCE4B9F4B79EF54EFFAEB7
SSDEEP:	12:sjBQqrb5zc+J6gwa7+D2UmCc6TatffPYh5WMfhzRxqBToT:aQIb26+D24cvlY3WK1yJoT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Actions looks like stealing of personal data
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Changes the autorun value in the registry
  - CCleaner64.exe (PID: 6164)
- Steals credentials from Web Browsers
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
SUSPICIOUS
- Reads the date of Windows installation
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
- Reads security settings of Internet Explorer
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Reads Internet Explorer settings
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Executable content was dropped or overwritten
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Checks Windows Trust Settings
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Searches for installed software
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Application launched itself
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 5712)
- The process verifies whether the antivirus software is installed
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)
- Checks for external IP
  - CCleaner64.exe (PID: 4644)
- Starts application from unusual location
  - CCleaner64.exe (PID: 4644)
INFO
- Reads the computer name
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)
- Checks supported languages
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Manual execution by a user
  - CCleaner64.exe (PID: 5712)
- Reads Environment values
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)
- Process checks computer location settings
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
- The process uses the downloaded file
  - CCleaner64.exe (PID: 5712)
  - CCleaner64.exe (PID: 4644)
- Reads the machine GUID from the registry
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Creates files in the program directory
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Reads the software policy settings
  - CCleaner64.exe (PID: 4644)
  - CCleaner64.exe (PID: 6164)
- Checks proxy server information
  - CCleaner64.exe (PID: 4644)
- Creates files or folders in the user directory
  - CCleaner64.exe (PID: 4644)
- Reads CPU info
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)
- Sends debugging messages
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)
- Reads product name
  - CCleaner64.exe (PID: 6164)
  - CCleaner64.exe (PID: 4644)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.der	\|	DER encoded X509 Certificate (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

133

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

4644

"C:\Program Files\CCleaner\CCleaner64.exe" /uac

C:\Program Files\CCleaner\CCleaner64.exe

CCleaner64.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

HIGH

Description:

CCleaner

Exit code:

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

5712

"C:\Program Files\CCleaner\CCleaner64.exe"

C:\Program Files\CCleaner\CCleaner64.exe

explorer.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

MEDIUM

Description:

CCleaner

Exit code:

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

6164

"C:\Program Files\CCleaner\CCleaner64.exe" /monitor

C:\Program Files\CCleaner\CCleaner64.exe

CCleaner64.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

HIGH

Description:

CCleaner

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

6196

"C:\WINDOWS\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\admin\AppData\Local\Temp\ocsp.digicert.com.der

C:\Windows\System32\rundll32.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

Add for printing

Total events

21 231

Read events

21 074

Write events

Delete events

Modification events


(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	DAST
Value: 09/14/2024 18:31:14
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	T8062
Value: 0
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	UpdateBackground
Value: 1
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:	write	Name:	SystemRestorePointCreationFrequency
Value: 0
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	delete value	Name:	CCleaner PostInstall
Value:
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	FTU
Value: 06/02/2024\|3\|1
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	GUID
Value:
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	GD
Value:
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	SetupGD
Value:
(PID) Process:	(4644) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	NumOfOutdatedDrivers
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4644	CCleaner64.exe	C:\Program Files\CCleaner\gcapi_dll.dll		executable
		MD5:F17F96322F8741FE86699963A1812897	SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
4644	CCleaner64.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms~RF12c423.TMP		binary
		MD5:715D03F2C851242AE02F082C92170337	SHA256:52F9047E9A072554A68045FD0215B8484C2D6D758FEE82543FBAA7C7F7D163D9
4644	CCleaner64.exe			—
		MD5:—	SHA256:—
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04		binary
		MD5:1FF8D020DFF0BB95C17CBF9D1675425A	SHA256:06B07CFC1DA30B3F85EA875CFF7D23503833E89CAE5111BE7874C082D6F436D4
4644	CCleaner64.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-ms		binary
		MD5:25672D22E62D3461140A5ED87047D1B6	SHA256:4136FCB880EE59B369E4B1372AF48B6E5371CA207232A7DCC0ACB7DABE6170CE
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\751E999B5FC4C0E2C30E01E0458BDE89_53FFDE8DA12AC28B5E7BC45CCE72BE2E		der
		MD5:D59C7977257D617EAEBAAAA4D92E28F1	SHA256:A04B43E6972EE0A88568E5D1841E8F833CB5911CD9547E44842CF2281C157C60
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA		binary
		MD5:0EE3859FC0E24B6BCA71C83B80B15498	SHA256:95A5A7ADFC77608C2BED2A5452FAC124ADFF8242F4092A969B172F9AB13C37FA
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\751E999B5FC4C0E2C30E01E0458BDE89_53FFDE8DA12AC28B5E7BC45CCE72BE2E		binary
		MD5:3EB2C6F1F8A7F424A1BDE978D947BDAE	SHA256:CB0A65C33F81A4A0940798CCFA95D1214E3D09A69E66E0B2B0768E4CBAD6599E
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04		der
		MD5:73CCED6609DA1921AFD5E8B1E39481CB	SHA256:6FB525CE7E64DDAFB2DAA8B7F7B5EFECD7B5C42F7A462A2BE673FCA91DBA4D1C
4644	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA		binary
		MD5:455E10CF23E9FCBCB30368661A5BA44E	SHA256:24E9B4BFF1C5F3CBC0736DC04D49C1322CB77C7B50547D639969F0D665D0ADB9

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6652	svchost.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	2.19.126.142:80	http://ncc.avast.com/ncc.txt	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	142.250.186.67:80	http://c.pki.goog/r/r1.crl	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	142.250.186.163:80	http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D	unknown	—	—	whitelisted
6164	CCleaner64.exe	GET	200	2.19.126.142:80	http://ncc.avast.com/ncc.txt	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	142.250.186.67:80	http://o.pki.goog/s/wr3/iqM/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQCKozflCGXy3RIwV8N3GSxA	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	142.250.186.67:80	http://o.pki.goog/s/wr3/tKg/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQC0qDqIEtY8IApzSgcUAYOk	unknown	—	—	whitelisted
2108	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4644	CCleaner64.exe	GET	200	104.18.38.233:80	http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
6420	RUXIMICS.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2120	MoUsoCoreWorker.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6652	svchost.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6652	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6652	svchost.exe	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4644	CCleaner64.exe	2.19.126.142:80	ncc.avast.com	Akamai International B.V.	DE	whitelisted
4644	CCleaner64.exe	34.117.223.223:443	analytics.avcdn.net	GOOGLE-CLOUD-PLATFORM	US	whitelisted
4644	CCleaner64.exe	2.19.225.128:443	www.ccleaner.com	AKAMAI-AS	FR	whitelisted
4644	CCleaner64.exe	34.160.176.28:443	shepherd.ff.avast.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.186.110	whitelisted
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59 40.127.240.158	whitelisted
www.microsoft.com	88.221.169.152 184.30.21.171	whitelisted
ncc.avast.com	2.19.126.142 2.19.126.158	whitelisted
analytics.avcdn.net	34.117.223.223	whitelisted
www.ccleaner.com	2.19.225.128	whitelisted
shepherd.ff.avast.com	34.160.176.28	whitelisted
ip-info.ff.avast.com	34.149.149.62	whitelisted
ocsp.pki.goog	142.250.186.163	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Misc activity	ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
4644	CCleaner64.exe	Misc activity	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI

Add for printing

Process	Message
CCleaner64.exe	[2024-09-14 18:31:14.847] [error ] [settings ] [ 4644: 3852] [000000: 0] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe	[2024-09-14 18:31:14.847] [error ] [ini_access ] [ 4644: 3852] [000000: 0] Incorrect ini_accessor configuration! Fixing relative input path to avoid recursion. Input was: Setup
CCleaner64.exe	Failed to open log file 'C:\Program Files\CCleaner'
CCleaner64.exe	OnLanguage - en
CCleaner64.exe	[2024-09-14 18:31:15.503] [error ] [settings ] [ 4644: 2128] [D2EC45: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe	[2024-09-14 18:31:15.534] [error ] [Burger ] [ 4644: 2128] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe	[2024-09-14 18:31:15.534] [error ] [Burger ] [ 4644: 2128] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe	file:///tis/optimizer.tis(1131) : warning :'await' should be used only inside 'async' or 'event'
CCleaner64.exe	file:///tis/optimizer.tis(1288) : warning :'async' does not contain any 'await'
CCleaner64.exe	startCheckingLicense()

General Info

ocsp.digicert.com

B846B882719E09EE4996593FE9CE2FDB

68F64B77CAB775E1B90B563325C0BF42C60E30BF

BEC22A671CF77D0BEB4395ABC6CEB14A9C02822997BCE4B9F4B79EF54EFFAEB7

12:sjBQqrb5zc+J6gwa7+D2UmCc6TatffPYh5WMfhzRxqBToT:aQIb26+D24cvlY3WK1yJoT

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

Changes the autorun value in the registry

Steals credentials from Web Browsers

SUSPICIOUS

Reads the date of Windows installation

Reads security settings of Internet Explorer

Reads Internet Explorer settings

Executable content was dropped or overwritten

Checks Windows Trust Settings

Searches for installed software

Application launched itself

The process verifies whether the antivirus software is installed

Checks for external IP

Starts application from unusual location

INFO

Reads the computer name

Checks supported languages

Manual execution by a user

Reads Environment values

Process checks computer location settings

The process uses the downloaded file

Reads the machine GUID from the registry

Creates files in the program directory

Reads the software policy settings

Checks proxy server information

Creates files or folders in the user directory

Reads CPU info

Sends debugging messages

Reads product name

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings