URL:

http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe

Full analysis: https://app.any.run/tasks/9d145008-b8af-47ad-b02f-e4c9a3eddeb2
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 06, 2019, 06:35:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MD5:

5CF7E754D585E4B3C1C40B3727CEEE79

SHA1:

886415F001D714356679828D8109C67365A7F12F

SHA256:

66878951252EBFFC26771B50FCB48594FA20F92930854631D1F91E332FB7C2A9

SSDEEP:

3:N1KaKElGRQyK3GjXX8QVD4N:Ca5Hy9jcQVD4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • chrome.exe (PID: 3488)

    • Application was dropped or rewritten from another process

      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2912)
      • 2345ShellPro.exe (PID: 2932)
      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2492)
      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345SafeSvc.exe (PID: 3272)
      • 2345SafeCenterSvc.exe (PID: 3308)
      • 2345SafeCenterInstaller.exe (PID: 3720)
      • 2345SafeCenterCrashReport.exe (PID: 3524)
      • 2345ShellPro.exe (PID: 3652)
      • 2345SoftMgr.exe (PID: 2884)

    • Loads dropped or rewritten executable

      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2912)
      • 2345ShellPro.exe (PID: 2932)
      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345SafeCenterSvc.exe (PID: 3308)
      • 2345RTProtect.exe (PID: 3416)
      • 2345SafeCenterCrashReport.exe (PID: 3524)
      • 2345ShellPro.exe (PID: 3652)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 2345SafeCenterInstaller.exe (PID: 3240)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3988)
      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2912)
      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345ShellPro.exe (PID: 2932)

    • Creates a software uninstall entry

      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2912)

    • Creates files in the user directory

      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345RTProtect.exe (PID: 3416)
      • 2345ShellPro.exe (PID: 2932)

    • Creates files in the Windows directory

      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345SafeCenterSvc.exe (PID: 3308)

    • Creates or modifies windows services

      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345ShellPro.exe (PID: 3652)

    • Creates files in the driver directory

      • 2345SafeCenterInstaller.exe (PID: 3240)

    • Executed as Windows Service

      • 2345SafeCenterSvc.exe (PID: 3308)
      • 2345SafeSvc.exe (PID: 3272)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3976)

    • Creates files in the program directory

      • 2345pcsafe_up_v5.0.5.11697.exe (PID: 2912)
      • 2345SafeCenterInstaller.exe (PID: 3240)
      • 2345RTProtect.exe (PID: 3416)

    • Reads Internet Cache Settings

      • 2345RTProtect.exe (PID: 3416)

    • Removes files from Windows directory

      • 2345RTProtect.exe (PID: 3416)

    • Uses IPCONFIG.EXE to discover IP address

      • 2345RTProtect.exe (PID: 3416)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3988)

    • Application launched itself

      • chrome.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
24
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 2345pcsafe_up_v5.0.5.11697.exe no specs 2345pcsafe_up_v5.0.5.11697.exe 2345shellpro.exe 2345safecenterinstaller.exe 2345safecentersvc.exe regsvr32.exe no specs 2345rtprotect.exe 2345safecenterinstaller.exe no specs 2345safecentercrashreport.exe no specs 2345shellpro.exe no specs 2345safesvc.exe 2345softmgr.exe no specs ipconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,2711083331668239575,8213410749563523969,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4336822367102529296 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,2711083331668239575,8213410749563523969,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10706554029338859673 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=980,2711083331668239575,8213410749563523969,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=296048182364050687 --mojo-platform-channel-handle=2908 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2492"C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe" C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe—chrome.exe
User:
admin
Company:
2345.cc
Integrity Level:
MEDIUM
Description:
2345安全卫士 v5.0 安装程序
Exit code:
3221226540
Version:
5.0.5.11697
Modules
Images
c:\users\admin\downloads\2345pcsafe_up_v5.0.5.11697.exe
c:\systemroot\system32\ntdll.dll
2884"C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe" --shortcut=notify --from=s --entry=12 --package="C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345softmgr_v5.0.1.11462.7z" --nwinst=1C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe—2345ShellPro.exe
User:
admin
Company:
2345.cc
Integrity Level:
HIGH
Description:
2345软件管家-主模块
Exit code:
0
Version:
5.0.1.11462
Modules
Images
c:\users\admin\appdata\roaming\softmgr_2345\2345softmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
2912"C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe" C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe
chrome.exe
User:
admin
Company:
2345.cc
Integrity Level:
HIGH
Description:
2345安全卫士 v5.0 安装程序
Exit code:
0
Version:
5.0.5.11697
Modules
Images
c:\users\admin\downloads\2345pcsafe_up_v5.0.5.11697.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2932"C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345ShellPro.exe" --type=install --installtype=new --lockCheckState=1C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345ShellPro.exe
2345pcsafe_up_v5.0.5.11697.exe
User:
admin
Company:
2345.cc
Integrity Level:
HIGH
Description:
2345安全卫士-安装辅助程序
Exit code:
0
Version:
5.0.5.11697
Modules
Images
c:\program files\2345soft\2345pcsafe\5.0.5.11697\2345shellpro.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2984"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=980,2711083331668239575,8213410749563523969,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=741790511122574553 --mojo-platform-channel-handle=3456 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3076"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6eafa9d0,0x6eafa9e0,0x6eafa9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3240"C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345SafeCenter\2345SafeCenterInstaller.exe" --type=install --invoke_product=1 --path="C:\Program Files\2345Soft\" --lockExplorerKB=0 --lockIEState=1 --lock3rdState=1 --lockBrowserState=1 --safe_override=0C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345SafeCenter\2345SafeCenterInstaller.exe
2345ShellPro.exe
User:
admin
Company:
2345.cc
Integrity Level:
HIGH
Description:
2345安全平台-组件安装
Exit code:
1
Version:
5.0.5.6611
Modules
Images
c:\program files\2345soft\2345pcsafe\5.0.5.11697\2345safecenter\2345safecenterinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 578
Read events
1 381
Write events
194
Delete events
3

Modification events

(PID) Process:(4056) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3988-13209546971030875
Value:
259
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:1512-13197841398593750
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3988-13209546971030875
Value:
259
Executable files
92
Suspicious files
73
Text files
66
Unknown types
17

Dropped files

PID
Process
Filename
Type
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e3ec31fa-30dc-49cc-888b-99e560b4d2e4.tmp —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF36d47f.TMPtext
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF36d4dd.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
24
DNS requests
17
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3416
2345RTProtect.exe
GET
—
42.62.30.180:80
http://42.62.30.180/
CN
—
—
whitelisted
3488
chrome.exe
GET
200
61.147.204.78:80
http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe
CN
executable
52.8 Mb
suspicious
3240
2345SafeCenterInstaller.exe
POST
200
221.228.75.116:80
http://update.khd.2345.cc/dmdt/dmdt_data.php
CN
text
232 b
malicious
3416
2345RTProtect.exe
POST
200
221.228.75.123:80
http://push.khd.2345.cc/token
CN
text
164 b
unknown
3240
2345SafeCenterInstaller.exe
POST
200
122.226.166.50:80
http://t.safe.2345.com/safe_realtime/index.php
CN
text
40 b
malicious
3240
2345SafeCenterInstaller.exe
POST
200
122.226.166.49:80
http://t.safe.2345.com/safe_realtime/index.php
CN
text
40 b
malicious
3240
2345SafeCenterInstaller.exe
POST
200
221.228.75.116:80
http://update.khd.2345.cc/safe_center/index.php
CN
binary
1 b
malicious
3240
2345SafeCenterInstaller.exe
POST
200
122.226.166.50:80
http://t.safe.2345.com/safe_realtime/index.php
CN
text
40 b
malicious
3240
2345SafeCenterInstaller.exe
POST
200
221.228.75.116:80
http://update.khd.2345.cc/safe_center/index.php
CN
binary
1 b
malicious
3240
2345SafeCenterInstaller.exe
POST
200
122.226.166.52:80
http://t.safe.2345.com/safe_realtime/index.php
CN
text
40 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
172.217.16.195:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3240
2345SafeCenterInstaller.exe
122.226.166.50:80
t.safe.2345.com
No.31,Jin-rong Street
CN
malicious
3240
2345SafeCenterInstaller.exe
122.226.166.49:80
t.safe.2345.com
No.31,Jin-rong Street
CN
malicious
3240
2345SafeCenterInstaller.exe
221.228.75.116:80
update.khd.2345.cc
No.31,Jin-rong Street
CN
malicious
3488
chrome.exe
216.58.205.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3416
2345RTProtect.exe
122.226.166.50:80
t.safe.2345.com
No.31,Jin-rong Street
CN
malicious
3416
2345RTProtect.exe
221.228.75.123:80
push.khd.2345.cc
No.31,Jin-rong Street
CN
unknown
3240
2345SafeCenterInstaller.exe
122.226.166.52:80
t.safe.2345.com
No.31,Jin-rong Street
CN
malicious
3416
2345RTProtect.exe
42.62.30.180:80
—
China Unicom Beijing Province Network
CN
unknown
3488
chrome.exe
172.217.16.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.2345.com
  • 61.147.204.78
  • 61.147.204.73
  • 61.147.204.74
  • 61.147.204.75
  • 61.147.204.76
  • 61.147.204.77
suspicious
clientservices.googleapis.com
  • 172.217.16.131
whitelisted
accounts.google.com
  • 172.217.18.173
shared
www.google.com
  • 216.58.208.36
malicious
ssl.gstatic.com
  • 172.217.16.195
whitelisted
sb-ssl.google.com
  • 172.217.21.206
whitelisted
www.gstatic.com
  • 172.217.16.195
whitelisted
clients1.google.com
  • 172.217.22.46
whitelisted
t.safe.2345.com
  • 122.226.166.50
  • 122.226.166.52
  • 122.226.166.48
  • 122.226.166.49
malicious
update.khd.2345.cc
  • 221.228.75.116
unknown

Threats

PID
Process
Class
Message
3488
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3488
chrome.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
3240
2345SafeCenterInstaller.exe
A Network Trojan was detected
MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc
1064
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3240
2345SafeCenterInstaller.exe
A Network Trojan was detected
MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc
3240
2345SafeCenterInstaller.exe
Misc activity
ADWARE [PTsecurity] PUA:Win32/Youxun
3240
2345SafeCenterInstaller.exe
A Network Trojan was detected
MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc
3240
2345SafeCenterInstaller.exe
Misc activity
ADWARE [PTsecurity] Downloader.AgentCRTD PUP (2345.cn)
1064
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3240
2345SafeCenterInstaller.exe
A Network Trojan was detected
MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc
Process
Message
2345SafeCenterSvc.exe
[3308:676:0806/073816:3721504084us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\57E60541-1540-4E0A-B505-88F6D4A547C8
2345SafeCenterSvc.exe
[3308:676:0806/073816:3721504351us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
2345SafeCenterSvc.exe
[3308:676:0806/073816:3721504647us:INFO:crash_service.cc(486)] dump start successfully
2345SafeCenterSvc.exe
[3308:676:0806/073816:3721504793us:INFO:crash_service_interface.cc(72)] ready to process crash requests
2345SafeCenterSvc.exe
[3308:3544:0806/073818:3724160982us:INFO:crash_service.cc(510)] client start. pid = 3416
2345SafeSvc.exe
[3272:2504:0806/073819:3725356014us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\FD439895-091C-4492-B2F7-16AA7CB46B87
2345SafeSvc.exe
[3272:2504:0806/073819:3725356236us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
2345SafeSvc.exe
[3272:2504:0806/073819:3725356483us:INFO:crash_service.cc(486)] dump start successfully
2345SafeSvc.exe
[3272:2504:0806/073819:3725356612us:INFO:crash_service_interface.cc(72)] ready to process crash requests
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe