File name:

validrive.exe

Full analysis: https://app.any.run/tasks/5d0e895c-d509-4846-a129-0d3d8eaf87b3
Verdict: Malicious activity
Analysis date: June 14, 2024, 11:18:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

EDE200303F5DFA7792CF73BE0914777E

SHA1:

147F0610A8AD3F157DCC1909459715306D606256

SHA256:

DEB6C2207559C27A55F9A1C6F9EC4FB7E149DB2D46143C90E6856145CACF8056

SSDEEP:

3072:Lx96pDofFnm38xr9pVViZcw+LXNx2BHk6j:v6pDwF99pVViZRcNxq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • validrive.exe (PID: 4076)
      • CCleaner.exe (PID: 2556)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 2556)

    • Steals credentials from Web Browsers

      • CCleaner.exe (PID: 2556)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • CCleaner.exe (PID: 2556)

    • Executable content was dropped or overwritten

      • CCleaner.exe (PID: 2556)

    • Checks Windows Trust Settings

      • CCleaner.exe (PID: 2556)

    • Reads Internet Explorer settings

      • CCleaner.exe (PID: 2556)

    • Reads the date of Windows installation

      • CCleaner.exe (PID: 2556)

    • Reads settings of System Certificates

      • CCleaner.exe (PID: 2556)

    • Searches for installed software

      • CCleaner.exe (PID: 2556)

    • Checks for external IP

      • CCleaner.exe (PID: 2556)

    • Reads the Internet Settings

      • CCleaner.exe (PID: 2556)

    • Reads Microsoft Outlook installation path

      • CCleaner.exe (PID: 2556)

    • Reads security settings of Internet Explorer

      • CCleaner.exe (PID: 2556)

  • INFO

    • Reads the computer name

      • validrive.exe (PID: 4076)
      • CCleaner.exe (PID: 1940)
      • CCleaner.exe (PID: 2556)
      • wmpnscfg.exe (PID: 1868)

    • Checks supported languages

      • CCleaner.exe (PID: 1940)
      • validrive.exe (PID: 4076)
      • CCleaner.exe (PID: 2556)
      • wmpnscfg.exe (PID: 1868)

    • Manual execution by a user

      • CCleaner.exe (PID: 1940)
      • wmpnscfg.exe (PID: 1868)

    • Reads Environment values

      • CCleaner.exe (PID: 1940)
      • CCleaner.exe (PID: 2556)

    • Reads CPU info

      • CCleaner.exe (PID: 2556)

    • Reads product name

      • CCleaner.exe (PID: 2556)

    • Reads the machine GUID from the registry

      • CCleaner.exe (PID: 2556)

    • Creates files in the program directory

      • CCleaner.exe (PID: 2556)

    • Reads the software policy settings

      • CCleaner.exe (PID: 2556)

    • Checks proxy server information

      • CCleaner.exe (PID: 2556)

    • Creates files or folders in the user directory

      • CCleaner.exe (PID: 2556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (v2.x) (51)
.exe | Win32 EXE PECompact compressed (generic) (35.9)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:08 18:23:48+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 22528
InitializedDataSize: 118272
UninitializedDataSize: -
EntryPoint: 0x362f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Author: Steve Gibson, Gibson Research Corporation, http://grc.com
CompanyName: Gibson Research Corp.
Description: ValiDrive: Quick 576-region spot-check for read/write error, performance and missing storage.
FileDescription: ValiDrive USB mass storage validator
FileVersion: 1.0.1
InternalName: ValiDrive.exe
LegalCopyright: Copyright © 2023 Gibson Research Corp.
OriginalFileName: ValiDrive.exe
ProductName: ValiDrive, freeware by Steve Gibson
ProductVersion: 1.0.1
WebSiteforUpdates: http://grc.com
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start validrive.exe ccleaner.exe no specs ccleaner.exe wmpnscfg.exe no specs validrive.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1868"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1940"C:\Program Files\CCleaner\CCleaner.exe" C:\Program Files\CCleaner\CCleaner.exe—explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
6.14.0.10584
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
2556"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
6.14.0.10584
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
3964"C:\Users\admin\AppData\Local\Temp\validrive.exe" C:\Users\admin\AppData\Local\Temp\validrive.exe—explorer.exe
User:
admin
Company:
Gibson Research Corp.
Integrity Level:
MEDIUM
Description:
ValiDrive USB mass storage validator
Exit code:
3221226540
Version:
1.0.1
Modules
Images
c:\users\admin\appdata\local\temp\validrive.exe
c:\windows\system32\ntdll.dll
4076"C:\Users\admin\AppData\Local\Temp\validrive.exe" C:\Users\admin\AppData\Local\Temp\validrive.exe
explorer.exe
User:
admin
Company:
Gibson Research Corp.
Integrity Level:
HIGH
Description:
ValiDrive USB mass storage validator
Exit code:
0
Version:
1.0.1
Modules
Images
c:\users\admin\appdata\local\temp\validrive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
18 041
Read events
17 790
Write events
174
Delete events
77

Modification events

(PID) Process:(4076) validrive.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoDriveTypeAutorun
Value:
4
(PID) Process:(4076) validrive.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoDriveTypeAutorun
Value:
0
(PID) Process:(2556) CCleaner.exeKey:HKEY_CURRENT_USER\Software\Piriform\CCleaner
Operation:writeName:DAST
Value:
06/14/2024 12:19:30
(PID) Process:(2556) CCleaner.exeKey:HKEY_CURRENT_USER\Software\Piriform\CCleaner
Operation:writeName:T8062
Value:
0
(PID) Process:(2556) CCleaner.exeKey:HKEY_CURRENT_USER\Software\Piriform\CCleaner
Operation:writeName:UpdateBackground
Value:
0
(PID) Process:(2556) CCleaner.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2556) CCleaner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(2556) CCleaner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2556) CCleaner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2556) CCleaner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
Executable files
3
Suspicious files
25
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:77E941187B57C6C8DA3254E141DE913A
SHA256:1BF120431ED8377829F11C2492F0569E441BF2FD7678CD62A1F1C3785DD8AFEF
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C73AD05C52BEA7DE01AD9E764E2E4081
SHA256:169DEDE0A38DE784C211EB23C56C69702ECA93772BF9E5C7EA37C03E8600577D
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:6739CB48C412FAB80F988F18C6D34637
SHA256:43882CD57D670F32247D62B898FA8DA8740F1917E63056713990434481EFE80D
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54FEBB76D3CE3919B47C90576AFBACB9_69772B4E79B356474E49AA786E9D5935binary
MD5:8F057F490521A90FDB4339B665A37524
SHA256:E6E5F967D2097316E69BE8F01408D85E32F83D0CAF91A08B8C424A631BAB0BC2
2556CCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\info[1].jsonbinary
MD5:F435EECC10A471ED71DCF0150531CBD1
SHA256:9CCD8D9871ADDF1363935B4124C0DF6FCFEC7009C2FE1B002AE9CA755C217995
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E119802D4B3FE78F9F8764B50AFCE398_14282B6565088689526A6A7C21E2E2FDder
MD5:DC2F80A585A8357D9ED870F44D390293
SHA256:DC0F98F4482249C03DED679AAAB1DB5FB0CC0578991D2933D503593C82C03761
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7137491880316DE4BCB5778DF26B80B9_C4602243A2F41B67C79EF7120684DE14der
MD5:611F6742C239039C22F3D118D5DC5223
SHA256:DABAB808B767C1AD5A3859BE9E893D7042680B845478B4CF4DF80FF9E12F4796
2556CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E119802D4B3FE78F9F8764B50AFCE398_14282B6565088689526A6A7C21E2E2FDbinary
MD5:2A0BA1A214D6434D1DC49A117B20CE5C
SHA256:04EF41FF725FA4A5D17E58E208CEE6AFD23CBE4D6C356006F6A63F0C7BF1F4E5
2556CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\18UEA3FT9G87JAV6IZ25.tempbinary
MD5:A22BDFA0CC57FFF2BAB53CEAD37F91F0
SHA256:78E2AC7252BABCE2C7DFDDE2DA5089C0A73D9A2FB6E82BEB28543A0B45DAFD16
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
23
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
CCleaner.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1be79b0df7ece73
unknown
—
—
unknown
2556
CCleaner.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?45d54b759559e0f6
unknown
—
—
unknown
2556
CCleaner.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?298db0d7f8e7cb17
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
23.48.23.31:80
http://ncc.avast.com/ncc.txt
unknown
—
—
unknown
2556
CCleaner.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9f0e66682d16409e
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
216.58.206.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
216.58.206.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/r1.crl
unknown
—
—
unknown
2556
CCleaner.exe
GET
200
216.58.206.35:80
http://ocsp.pki.goog/s/gts1d4/5DxBwTCF08g/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEHfd%2BYJXFoj1CbMBkm%2FoAe4%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2556
CCleaner.exe
23.48.23.31:80
ncc.avast.com
Akamai International B.V.
DE
unknown
2556
CCleaner.exe
34.117.223.223:443
analytics.ff.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2556
CCleaner.exe
34.149.149.62:443
ip-info.ff.avast.com
GOOGLE
US
unknown
2556
CCleaner.exe
34.111.24.1:443
ipm-provider.ff.avast.com
GOOGLE
US
unknown
2556
CCleaner.exe
34.160.176.28:443
shepherd.ff.avast.com
GOOGLE
US
unknown
2556
CCleaner.exe
2.19.217.211:443
www.ccleaner.com
Akamai International B.V.
NL
unknown
2556
CCleaner.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
ncc.avast.com
  • 23.48.23.31
  • 23.48.23.10
whitelisted
analytics.ff.avast.com
  • 34.117.223.223
whitelisted
ip-info.ff.avast.com
  • 34.149.149.62
whitelisted
www.ccleaner.com
  • 2.19.217.211
whitelisted
shepherd.ff.avast.com
  • 34.160.176.28
whitelisted
ipm-provider.ff.avast.com
  • 34.111.24.1
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.pki.goog
  • 216.58.206.35
whitelisted
c.pki.goog
  • 216.58.206.35
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2556
CCleaner.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
Process
Message
CCleaner.exe
[2024-06-14 11:19:30.118] [error ] [settings ] [ 2556: 2020] [6000C4: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
OnLanguage - en
CCleaner.exe
[2024-06-14 11:19:31.399] [error ] [settings ] [ 2556: 2344] [9434E9: 359] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner.exe
[2024-06-14 11:19:31.431] [error ] [Burger ] [ 2556: 2344] [FDA25D: 244] [23.1.806.0] [BurgerReporter.cpp] [244] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
[2024-06-14 11:19:31.431] [error ] [Burger ] [ 2556: 2344] [FDA25D: 244] [23.1.806.0] [BurgerReporter.cpp] [244] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
startCheckingLicense()
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
validrive.exe