URL:

https://pic.2345.cc

Full analysis: https://app.any.run/tasks/4771c8fd-a76a-4da3-9eaa-7dca56249f70
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 20, 2020, 02:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
Indicators:
MD5:

33435F496DC335A730DD1744434A6D68

SHA1:

EC4696B2F14A9BE2EFD91AB788C0EBA36C8E6C37

SHA256:

0C467824269B558CF9B8D137E0CAD8F8B9E27CC22DC75761F8510942E1C326A1

SSDEEP:

3:N8ImiGn:2I5G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)
      • 2345PicLoader.exe (PID: 2264)
      • 2345PicLoader.exe (PID: 956)
      • 2345PicLoader.exe (PID: 3384)
      • 2345PicLoader.exe (PID: 3208)
      • 2345PicUpdate.exe (PID: 2792)
      • Pic_2345Svc.exe (PID: 1276)
      • 2345PicLoader.exe (PID: 2088)
      • 2345PicUpdate.exe (PID: 2524)

    • Application was dropped or rewritten from another process

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)
      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 1800)
      • 2345PicLoader.exe (PID: 2264)
      • 2345PicLoader.exe (PID: 956)
      • 2345PicLoader.exe (PID: 3384)
      • ServiceManager.exe (PID: 1868)
      • 2345PicLoader.exe (PID: 3208)
      • 2345PicUpdate.exe (PID: 2792)
      • Pic_2345Svc.exe (PID: 1276)
      • 2345PicUpdate.exe (PID: 2524)
      • 2345PicLoader.exe (PID: 2088)

    • Changes settings of System certificates

      • 2345PicLoader.exe (PID: 2264)
      • 2345PicLoader.exe (PID: 3384)
      • 2345PicUpdate.exe (PID: 2792)

    • Loads the Task Scheduler COM API

      • 2345PicLoader.exe (PID: 3384)

    • Downloads executable files from the Internet

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 972)
      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)

    • Creates files in the program directory

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)
      • Pic_2345Svc.exe (PID: 1276)

    • Creates COM task schedule object

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)

    • Adds / modifies Windows certificates

      • 2345PicLoader.exe (PID: 2264)
      • 2345PicLoader.exe (PID: 3384)
      • 2345PicUpdate.exe (PID: 2792)

    • Creates files in the user directory

      • 2345PicLoader.exe (PID: 2264)
      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)
      • 2345PicLoader.exe (PID: 956)
      • 2345PicLoader.exe (PID: 3384)
      • 2345PicUpdate.exe (PID: 2792)
      • 2345PicLoader.exe (PID: 3208)
      • 2345PicLoader.exe (PID: 2088)
      • 2345PicUpdate.exe (PID: 2524)

    • Creates a software uninstall entry

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)

    • Application launched itself

      • 2345PicLoader.exe (PID: 3384)

    • Executed as Windows Service

      • Pic_2345Svc.exe (PID: 1276)

    • Reads Internet Cache Settings

      • 2345pic_000000_v10.0.0.8852_setup.exe (PID: 3048)
      • 2345PicUpdate.exe (PID: 2524)

    • Modifies the open verb of a shell class

      • 2345PicLoader.exe (PID: 3384)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 252)
      • chrome.exe (PID: 972)

    • Application launched itself

      • chrome.exe (PID: 972)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 972)

    • Reads settings of System Certificates

      • 2345PicLoader.exe (PID: 3384)
      • chrome.exe (PID: 252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
23
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 2345pic_000000_v10.0.0.8852_setup.exe no specs 2345pic_000000_v10.0.0.8852_setup.exe chrome.exe no specs 2345picloader.exe no specs 2345picloader.exe no specs 2345picloader.exe servicemanager.exe no specs 2345picloader.exe no specs 2345picupdate.exe pic_2345svc.exe 2345picloader.exe no specs 2345picupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1048,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=12258419148334633966 --mojo-platform-channel-handle=1484 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
956"C:\Program Files\2345Soft\2345Pic\2345PicLoader.exe" -recorderRealtimeStat aq_01#0;aq_02#C:\Program Files\2345Soft\2345Pic\2345PicLoader.exe—2345pic_000000_v10.0.0.8852_setup.exe
User:
admin
Company:
2345移动科技
Integrity Level:
HIGH
Description:
2345看图王-引擎加载程序
Exit code:
0
Version:
10.0.0.8852
Modules
Images
c:\program files\2345soft\2345pic\2345picloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
972"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://pic.2345.cc"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12941423342645669097 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1276"C:\Program Files\2345Soft\2345Pic\protect\Pic_2345Svc.exe"C:\Program Files\2345Soft\2345Pic\protect\Pic_2345Svc.exe
services.exe
User:
SYSTEM
Company:
2345移动科技
Integrity Level:
SYSTEM
Description:
2345看图王核心服务
Exit code:
0
Version:
10.7.3.1566
Modules
Images
c:\program files\2345soft\2345pic\protect\pic_2345svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1800"C:\Users\admin\Downloads\2345pic_000000_v10.0.0.8852_setup.exe" C:\Users\admin\Downloads\2345pic_000000_v10.0.0.8852_setup.exe—chrome.exe
User:
admin
Company:
2345移动科技
Integrity Level:
MEDIUM
Description:
2345看图王 v10.0 安装程序
Exit code:
3221226540
Version:
10.0.0.8852
Modules
Images
c:\users\admin\downloads\2345pic_000000_v10.0.0.8852_setup.exe
c:\systemroot\system32\ntdll.dll
1868"C:\Program Files\2345Soft\2345Pic\protect\ServiceManager.exe" install "C:\Program Files\2345Soft\2345Pic\protect\Pic_2345Svc.exe"C:\Program Files\2345Soft\2345Pic\protect\ServiceManager.exe—2345PicLoader.exe
User:
admin
Company:
2345移动科技
Integrity Level:
HIGH
Description:
2345看图王核心服务
Exit code:
0
Version:
10.7.3.1566
Modules
Images
c:\program files\2345soft\2345pic\protect\servicemanager.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
1968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5175334687048703133 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2088"C:\Program Files\2345Soft\2345Pic\2345PicLoader.exe" -skinselected 0C:\Program Files\2345Soft\2345Pic\2345PicLoader.exe—2345pic_000000_v10.0.0.8852_setup.exe
User:
admin
Company:
2345移动科技
Integrity Level:
HIGH
Description:
2345看图王-引擎加载程序
Exit code:
0
Version:
10.0.0.8852
Modules
Images
c:\program files\2345soft\2345pic\2345picloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2236"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=960 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 082
Read events
1 673
Write events
1 387
Delete events
22

Modification events

(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2236) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:972-13250312124655750
Value:
259
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(972) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
114
Suspicious files
30
Text files
87
Unknown types
8

Dropped files

PID
Process
Filename
Type
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FB726BD-3CC.pma —
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f9ebe4c7-2627-466d-98f4-7387ac492536.tmp —
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF18d2ac.TMPtext
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF18d2eb.TMPtext
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF18d481.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
19
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3048
2345pic_000000_v10.0.0.8852_setup.exe
GET
—
218.12.76.151:80
http://download.2345.cn/2345explorer/background/2345Explorer_000065.exe
CN
—
—
whitelisted
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.117:80
http://update.inst.2345.com/nindex.php
CN
text
11.5 Kb
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
GET
200
120.52.95.242:80
http://download.2345.com/2345pcsafe/SafePolicy/SafeSetup/200604/2345pcsafe_100162_pickb.exe
CN
executable
63.4 Mb
suspicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.kehuduan.2345.com/proc/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.inst.2345.com/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.kehuduan.2345.com/proc/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.kehuduan.2345.com/proc/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.inst.2345.com/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.kehuduan.2345.com/proc/inst/index.php
CN
text
40 b
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
POST
200
221.228.75.241:80
http://t.inst.2345.com/inst/index.php
CN
text
40 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2792
2345PicUpdate.exe
221.228.108.9:443
update-pic.2345.cc
No.31,Jin-rong Street
CN
malicious
3048
2345pic_000000_v10.0.0.8852_setup.exe
221.228.75.117:80
update.inst.2345.com
No.31,Jin-rong Street
CN
malicious
2524
2345PicUpdate.exe
221.228.108.9:443
update-pic.2345.cc
No.31,Jin-rong Street
CN
malicious
2524
2345PicUpdate.exe
221.228.75.241:443
t-kehuduan.2345.com
No.31,Jin-rong Street
CN
malicious
252
chrome.exe
216.58.207.78:443
clients1.google.com
Google Inc.
US
whitelisted
252
chrome.exe
172.217.21.238:443
clients4.google.com
Google Inc.
US
whitelisted
3048
2345pic_000000_v10.0.0.8852_setup.exe
221.228.75.241:80
t-kehuduan.2345.com
No.31,Jin-rong Street
CN
malicious
252
chrome.exe
221.228.199.115:443
pic.2345.cc
No.31,Jin-rong Street
CN
unknown
252
chrome.exe
216.58.206.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
252
chrome.exe
180.101.190.126:443
union2.50bang.org
No.31,Jin-rong Street
CN
unknown

DNS requests

Domain
IP
Reputation
pic.2345.cc
  • 221.228.199.115
malicious
accounts.google.com
  • 108.177.104.84
shared
hm.baidu.com
  • 103.235.46.191
whitelisted
ssl.gstatic.com
  • 216.58.206.3
whitelisted
union2.50bang.org
  • 180.101.190.126
suspicious
dl.2345.com
  • 120.52.95.243
  • 120.52.95.242
  • 218.12.76.151
  • 218.12.76.150
malicious
sb-ssl.google.com
  • 64.233.180.190
  • 64.233.180.136
  • 64.233.180.91
  • 64.233.180.93
whitelisted
update-pic.2345.cc
  • 221.228.108.9
malicious
t-pic.2345.com
  • 221.228.75.211
malicious
update.inst.2345.com
  • 221.228.75.117
malicious

Threats

PID
Process
Class
Message
1044
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1044
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ADWARE [PTsecurity] PUA:Win32/Youxun
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ADWARE [PTsecurity] 2345Suite.Install
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD)
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ADWARE [PTsecurity] 2345Suite.Install
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD)
3048
2345pic_000000_v10.0.0.8852_setup.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3048
2345pic_000000_v10.0.0.8852_setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3048
2345pic_000000_v10.0.0.8852_setup.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
Process
Message
Pic_2345Svc.exe
RpcServerUseProtseqEpW 6cc
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://pic.2345.cc