File name:

CCleaner.7z

Full analysis: https://app.any.run/tasks/933bedf5-fb28-4850-b9f7-b08022c536d9
Verdict: Malicious activity
Threats:

PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 19:28:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
evasion
privateloader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

8D2413B374B933D2B80F542E08C4238D

SHA1:

82F07FC1F2B32F42D6865679DE0E0C366C68293F

SHA256:

F81294FED725868329940B5FBDD29960E7B3EAD7E90F9005DE5F6E1FA2CC3241

SSDEEP:

98304:MLss3n2Lsx9E40Op7DWmPRJYCtdQckEOj8Ah3HqZuTcoSGmwmNdl6Tgrj+PP/NBD:21bPTD8wluDPN0f/T5AtGHmH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2432)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Steals credentials from Web Browsers

      • CCleaner.exe (PID: 7804)

    • PRIVATELOADER has been detected (YARA)

      • CCleaner.exe (PID: 7804)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2432)
      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7660)
      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Application launched itself

      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7660)

    • Executable content was dropped or overwritten

      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • Reads Internet Explorer settings

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Searches for installed software

      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • Checks for external IP

      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • Reads Microsoft Outlook installation path

      • CCleaner.exe (PID: 7804)

    • The process verifies whether the antivirus software is installed

      • CCleaner.exe (PID: 7804)

    • The process checks if it is being run in the virtual environment

      • CCleaner.exe (PID: 7804)

    • Starts application from unusual location

      • CCleaner.exe (PID: 7804)

  • INFO

    • Reads the computer name

      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7660)
      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Checks supported languages

      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7660)
      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Reads Environment values

      • CCleaner.exe (PID: 7660)
      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • Process checks computer location settings

      • CCleaner.exe (PID: 7592)
      • CCleaner.exe (PID: 7660)
      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Checks proxy server information

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Create files in a temporary directory

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Reads the machine GUID from the registry

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Reads product name

      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • Reads CPU info

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Reads the software policy settings

      • CCleaner.exe (PID: 7876)
      • CCleaner.exe (PID: 7804)

    • The sample compiled with english language support

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Creates files or folders in the user directory

      • CCleaner.exe (PID: 7804)
      • CCleaner.exe (PID: 7876)

    • Reads Microsoft Office registry keys

      • CCleaner.exe (PID: 7804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2025:04:09 10:05:08+00:00
ArchivedFileName: CCleaner.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
7
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs ccleaner.exe no specs ccleaner.exe no specs #PRIVATELOADER ccleaner.exe ccleaner.exe

Process information

PID
CMD
Path
Indicators
Parent process
2432"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\CCleaner.7zC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7276C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7308"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7592"C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\CCleaner.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\CCleaner.exe—WinRAR.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
6.35.0.11488
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2432.14105\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7660"C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14341\CCleaner.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14341\CCleaner.exe—WinRAR.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
6.35.0.11488
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2432.14341\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7804"C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\CCleaner.exe" /uacC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\CCleaner.exe
CCleaner.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.35.0.11488
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2432.14105\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14341\CCleaner.exe" /uacC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14341\CCleaner.exe
CCleaner.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.35.0.11488
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2432.14341\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
24 265
Read events
23 890
Write events
207
Delete events
168

Modification events

(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\CCleaner.7z
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7804) CCleaner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:writeName:DAST
Value:
05/25/2025 19:28:56
(PID) Process:(7804) CCleaner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:writeName:UpdateBackground
Value:
1
Executable files
7
Suspicious files
189
Text files
38
Unknown types
0

Dropped files

PID
Process
Filename
Type
2432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\CCleaner.exe —
MD5:—
SHA256:—
2432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14341\CCleaner.exe —
MD5:—
SHA256:—
7804CCleaner.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\gcapi_17482013377804.dllexecutable
MD5:F637D5D3C3A60FDDB5DD397556FE9B1D
SHA256:641B843CB6EE7538EC267212694C9EF0616B9AC9AB14A0ABD7CF020678D50B02
7804CCleaner.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\Setup\config.deftext
MD5:05927E894C81EB42C3B4DAE5A5A6C937
SHA256:09C65B39BC891E12956AB7BB30FAE147EF7C8FA37542B6F040613436B566E7F8
7804CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555Ebinary
MD5:F36961CB8BDCECA4A1A15D8BE006BBBE
SHA256:ABC2E8A52899364D3BCEF657C00624C9B4BB995B9EFA5C1E3E32E2B7D678DD6C
7804CCleaner.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2432.14105\gcapi_dll.dllexecutable
MD5:F637D5D3C3A60FDDB5DD397556FE9B1D
SHA256:641B843CB6EE7538EC267212694C9EF0616B9AC9AB14A0ABD7CF020678D50B02
7876CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\80f95e07734d4c3f.customDestinations-msbinary
MD5:A4647879B769E8098819E3D7D2CC894C
SHA256:ED46D6B3058335F0C654A1B4D392BCC4B7B5B5FA54481A630871B5E9C6C45BC5
7804CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:36D2AD293F1A40B58CF34866C92F33EB
SHA256:53D92FF75E74557D811EC2241B70826F66A1810F64955894DFEA6D9EC14325E1
7876CCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IS8EDP30I1YAITXL2WYY.tempbinary
MD5:A4647879B769E8098819E3D7D2CC894C
SHA256:ED46D6B3058335F0C654A1B4D392BCC4B7B5B5FA54481A630871B5E9C6C45BC5
7804CCleaner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:C22301B5245B697AA0D960E7D3A2D560
SHA256:8E63BB9D833DDFF90DB225799A6B20821540B2A10AB3764EE07767259765DA0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
45
DNS requests
26
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6004
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7804
CCleaner.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
7804
CCleaner.exe
GET
200
23.50.131.202:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7876
CCleaner.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
7876
CCleaner.exe
GET
200
23.50.131.202:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
7876
CCleaner.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
7804
CCleaner.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1196
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7804
CCleaner.exe
23.50.131.202:80
ncc.avast.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.164
  • 23.48.23.143
  • 23.48.23.194
  • 23.48.23.145
  • 23.48.23.147
  • 23.48.23.166
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ncc.avast.com
  • 23.50.131.202
  • 23.50.131.204
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.0
  • 20.190.159.131
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
analytics.avcdn.net
  • 34.117.223.223
whitelisted
shepherd.ff.avast.com
  • 34.160.176.28
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
7804
CCleaner.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
7876
CCleaner.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CCleaner.7z