Trojan.Win32.FlyStudio_d557fb80c9

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

³ÉÆ·.exe:1908
2345SFGuard.exe:2368
2345SoftSvc.exe:136
2345RTProtect.exe:2136
2345AvScan.exe:2092
2345AvScan.exe:2236
2345AvScan.exe:552
2345SoftMgr.exe:1948
2345SoftMgr.exe:1548
2345SoftMgr.exe:588
2345SoftMgr.exe:228
2345ExtShell.exe:1164
2345ExtShell.exe:244
2345ShellPro.exe:1128
2345ShellPro.exe:460
2345ShellPro.exe:480
ºÇºÇ.exe:1316
2345softmgr_setup.exe:1888
2345SafeSvc.exe:408
2345pcsafe_k1742288.exe:1488

The Trojan injects its code into the following process(es):

2345GlobalData.exe:1928
2345MPCSafe.exe:1856
2345RTProtect.exe:2084
2345SafeTray.exe:1144
%original file name%.exe:1772

Mutexes

The following mutexes were created/opened:

DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}__DDrawCheckExclMode____DDrawExclMode__DDrawWindowListMutexDDrawDriverObjectListMutexRasPbFileShimCacheMutex

File activity

The process 2345GlobalData.exe:1928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (1808 bytes)
%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data (2936 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (0 bytes)

The process 2345MPCSafe.exe:1856 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EK21GOA4\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LARCTEJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\config\exam.ini (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WP2Z412Z\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CX67KLI7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#D.tmp (1269 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\RT~F.tmp (0 bytes)

The process 2345RTProtect.exe:2084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#10.tmp (1573 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345AntiVirus\rccfginfo.tmp (29 bytes)
%WinDir% (8 bytes)
%Documents and Settings%\%current user%\Application Data (4 bytes)
C:\$Directory (2980 bytes)
%Program Files%\Windows NT (4 bytes)
%System% (2672 bytes)
%Program Files%\2345Soft\2345PCSafe (96 bytes)
%Program Files% (96 bytes)
%Program Files%\2345Soft\2345SoftMgr (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe (4 bytes)
%System%\config (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345AvScan\2345MonCfg.data (29 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat.tmp (29 bytes)

The process 2345SafeTray.exe:1144 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#16.tmp (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#11.tmp (1269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#15.tmp (1541 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\2345UpdateConfig.ini (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#12.tmp (1397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#13.tmp (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#14.tmp (1541 bytes)

The process 2345SoftMgr.exe:1548 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#E.tmp (197 bytes)

The process 2345SoftMgr.exe:588 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Desktop\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#B.tmp (197 bytes)
%Documents and Settings%\%current user%\Application Data\2345SoftMgr\config\softmgr (29 bytes)
%Documents and Settings%\%current user%\Start Menu\强力卸载电脑中的软件 .lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)

The process %original file name%.exe:1772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ºÇºÇ.exe (85707 bytes)
C:\³ÉÆ·.exe (5442 bytes)

The process 2345ShellPro.exe:460 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#A.tmp (997 bytes)
%System%\config\SYSTEM.LOG (12371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#7.tmp (485 bytes)
%System%\drivers\2345FsMon.sys (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#8.tmp (725 bytes)
%System%\config\system (5919 bytes)
%System%\config (864 bytes)
%System%\drivers\2345NetMon.sys (28 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\2345Config.data (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#9.tmp (885 bytes)
%System%\drivers\2345RegMon.sys (90 bytes)

The process 2345ShellPro.exe:480 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
%Documents and Settings%\%current user%\Desktop\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)

The process ºÇºÇ.exe:1316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (84488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HZ~C.tmp.bat (84 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448 (0 bytes)

The process 2345softmgr_setup.exe:1888 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softuninstall.ico (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (3754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (239 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeDispatcher.dll (2321 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftLocal.dll (4545 bytes)
%Program Files%\2345Soft\2345SoftMgr\sqlite3.dll (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (1808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (15021 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeUpdate.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (3883 bytes)
%Program Files%\2345Soft\2345SoftMgr\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (1703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (1703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (239 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftUtils.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (3744 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftUninstall.dll (4545 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftBox.dll (15799 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345softNotify.exe (3361 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgrDB.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (3883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (1859 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftSvc.exe (1281 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftLib.dll (2321 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (334176 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345font (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (1650 bytes)
%Program Files%\2345Soft\2345SoftMgr\Uninstall.exe (3910 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (3744 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softupdateremind.ico (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (1723 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softclass.dat (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (262 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftInstaller.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp (4 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeDB.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (4992 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe (32873 bytes)
%Program Files%\2345Soft\2345SoftMgr\msvcp110.dll (1816 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\defaultsoft.ico (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (15021 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss5.tmp (363999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (1816 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftService.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (3754 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (0 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (0 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe55c6a1c4.tmp (0 bytes)

The process 2345pcsafe_k1742288.exe:1488 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\2345Soft\2345PCSafe\sqlite3.dll (1808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (24832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (129 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeUpdate.dll (213 bytes)
%Program Files%\2345Soft\2345PCSafe\msvcp110.dll (1816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (7386 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\optimize.dat (34773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (141 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ExtShell.exe (2105 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFGuard.exe (5441 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe (12287 bytes)
%Program Files%\2345Soft\2345PCSafe\Uninstall.exe (16877 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\exam.dat (4992 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\fsmon.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (3737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (3845 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (175 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\trash.dat (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (137 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFEMon.dll (192 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeUtils.exe (7726 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ProcessApi.dll (25 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvCloudQuery.dll (315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (214 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeOptimize.dll (1671 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (213 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeSvc.exe (1281 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeExam.dll (9606 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat (2 bytes)
%System%\drivers\2345PowerApi.sys (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (1628 bytes)
%Program Files%\2345Soft\2345PCSafe\2345RTProtect.exe (18248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (870976 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeDispatcher.dll (1706 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeService.dll (137 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFBase.dll (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (132 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\bwinfo.dat (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (98 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\system64.dat (58402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (9606 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll (175 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFWebMon.dll (229 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ShellPro.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (286 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFWebShell.exe (601 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\TurnOffSoft.dat (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (25429 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\system.dat (95827 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScan.exe (601 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeGarbage.dll (7972 bytes)
%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe (69512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp (4 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScan.dll (294 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\office64.dat (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (1628 bytes)
%Program Files%\2345Soft\2345PCSafe\2345InstallerPowerApi.dll (32 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeDB.dll (127 bytes)
%Program Files%\2345Soft\2345PCSafe\2345FsMon.dll (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (1625 bytes)
%Program Files%\2345Soft\2345PCSafe\2345GlobalData.exe (13122 bytes)
%Program Files%\2345Soft\2345PCSafe\msvcr110.dll (6316 bytes)
%Program Files%\2345Soft\2345PCSafe\2345NetMon.dll (132 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeNotify.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (3737 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScanEngine.dll (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (246 bytes)
%Program Files%\2345Soft\2345PCSafe\2345RegMon.dll (286 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeHotfix.dll (7972 bytes)
%Program Files%\2345Soft\2345PCSafe\2345BrowserDl.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (34007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (4992 bytes)
%Program Files%\2345Soft\2345PCSafe\2345softmgr_setup.exe (26831 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\office.dat (26688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (1816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (32 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (0 bytes)
%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe55c6a1bf.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (0 bytes)

Registry activity

The process ³ÉÆ·.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 44 07 2C 97 7E D8 00 45 EF 0B 47 82 CF 3A 11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process 2345GlobalData.exe:1928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 54 0E A7 CE 1B 6E AA 3C 87 61 4E 3A A1 F5 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SFGuard.exe:2368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 82 A1 09 C8 FE B4 0D 2A AC 7D 7E AC DD BA D4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SoftSvc.exe:136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 90 30 17 2C 3F 36 1D 71 80 49 16 1B C7 3A 74"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The process 2345MPCSafe.exe:1856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\2345Soft\2345PCSafe]
"2345RTProtect.exe" = "2345实时防护中心"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 68 76 E1 8C 22 47 3A 95 98 40 BC D6 DC 42 99"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345RTProtect.exe:2136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 76 8F 92 5F 74 5A 0D BB BB BF A2 8C 2E B8 C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345RTProtect.exe:2084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 1F 9B F2 7E 41 28 64 E2 8E 04 50 53 F8 A4 06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345SafeTray.exe:1144 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"PerceivedType" = "text"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F4B47BB2]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\227CB6CB]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7BA4C1F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B6A7E8DD]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83]
"(Default)" = ""

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\61ACD2B7\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\949FC460\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9B08845D]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7D4C3737\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\35732529]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\DD8B9738\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B6A7E8DD\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E60B5EC0]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\1C923714]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\249E2216]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B51D140C]
"(Default)" = ""

[HKCR\.html]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\94F2CC9A\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B41C711A]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B51D140C\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xht]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\1C923714\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\A71DD47B]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\156BC696]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\EE676FFB]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\3A0CB4F9]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCR\HTTP\shell]
"(Default)" = ""

[HKCU\Software\Classes\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\94F2CC9A]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\57E65BB8]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E60B5EC0\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E890A79F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\https\shell]
"(Default)" = ""

[HKCR\.xhtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"PerceivedType" = "text"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FACB3BCF]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F4B47BB2\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FACB3BCF\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\949FC460]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8CCACF3D\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B41C711A\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7D4C3737]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCR\htmlfile\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec]
"NoActivateHandler" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E308FE55]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\DD8B9738]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C C2 7E AB 13 DA F9 C3 EF AE B1 81 8A 92 44 B2"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\69F3D1C6]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FBDF724B]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FD689294]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7BA4C1F\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E890A79F\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92377A40\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCU\Software\Classes\https\shell]
"(Default)" = ""

[HKCR\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E09EB3BD\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\OpenWithList]
"c" = "MSI167.tmp"
"b" = "NOTEPAD.EXE"
"a" = "iexplore.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.html]
"(Default)" = "htmlfile"

[HKCU\Software\Classes\http\shell]
"(Default)" = ""

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8CCACF3D]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\A51058E3]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"(Default)" = "htmlfile"

[HKCU\Software\Classes\htmlfile\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E873A8E0]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\5E4C2F68]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\ifExec]
"(Default)" = "*"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\AAE5463]
"PerceivedType" = "text"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec]
"NoActivateHandler" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\61ACD2B7]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E873A8E0\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\450DF079]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\6F0F4032\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.htm]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\2D9E3006]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9B08845D\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92A3EB6F]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec]
"NoActivateHandler" = ""

[HKCR\.htm]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92A3EB6F\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8E2C0F32]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F8AE33E8]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\57E65BB8\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\OpenWithList]
"MRUList" = "cba"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\6F0F4032]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9027F903\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8F3519D5\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9027F903]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8F3519D5]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"Content Type" = "text/html"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E09EB3BD]
"Progid" = "htmlfile"

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FD689294\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92377A40]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"Content Type" = "text/html"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\AAE5463]
"(Default)" = "htmlfile"

[HKCR\ftp\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\C8F833B2]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKCR\.xht]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\2345Soft\2345PCSafe]
"2345SFGuard.exe" = "2345安全中心-防护模块"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E308FE55\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B07F248D]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7836E0A9]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\67F7090D]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 2345AvScan.exe:2092 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 5B AB 57 11 FF 05 D2 36 3C 2D D6 BF EE DE 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345AvScan.exe:2236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 D8 66 05 59 91 9F EE 82 CE EE 7D A2 7E F7 DC"

The process 2345AvScan.exe:552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 75 D0 03 BB 02 E1 94 78 B1 95 52 6E AD E0 D3"

The process 2345SoftMgr.exe:1948 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 59 2C A6 32 1D A7 7C 9D 35 1B AB D7 A3 4F 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process 2345SoftMgr.exe:1548 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 5D 0A D5 3F 6B A2 94 AE 86 88 A6 F4 BA 24 F7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SoftMgr.exe:588 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 D6 14 43 6D 3E A9 29 D2 C0 E3 DB 08 32 9B 53"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process 2345SoftMgr.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 36 00 9E C9 78 42 30 08 33 A5 A7 78 1A F7 4D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2345SoftMgr" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe --type=start_service"

The process %original file name%.exe:1772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 A0 27 AF 70 3F BE F1 B2 0D 78 68 45 35 A0 B1"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"MostRecentStart" = "9E 83 F7 23 3C D2 D0 01"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k34799713"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"Version" = "00 07 00 00"
"ID" = "D557FB80C9F6A7096FF0B15825BE72ED.EXE558BA74900F5E000"
"Name" = "D557FB80C9F6A7096FF0B15825BE72ED.EXE"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The process 2345ExtShell.exe:1164 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 66 80 45 DA 5E D0 C5 E9 BA 91 A5 AF 40 0B D9"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32]
"(Default)" = "%Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll"

[HKCR\Drive\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Directory\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\*\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\Folder\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}]
"(Default)" = "2345 PC Safe Shell Extension"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{C4F75DB1-B9F4-425A-9F5B-778911BCF176}" = "2345 PC Safe Shell Extension"

[HKCR\lnkfile\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

The Trojan deletes the following registry key(s):

[HKCR\Directory\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\*\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\Drive\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\lnkfile\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\Folder\shellex\ContextMenuHandlers\2345PCSafe]

The process 2345ExtShell.exe:244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 17 86 54 C9 71 C0 9F 5B 67 DF CB ED 77 83 6B"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

The process 2345ShellPro.exe:1128 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE C1 F5 22 1A 22 E3 FF 3E 4D 05 72 E7 FF 79 93"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process 2345ShellPro.exe:460 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"DisplayName" = "2345FsMon"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"ImagePath" = "system32\drivers\2345FsMon.sys"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKCR\.html]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.html]
"(Default)" = "htmlfile"

[HKCR\HTTP\shell]
"(Default)" = ""

[HKCU\Software\Classes\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell]
"(Default)" = ""

[HKCR\.xhtml]
"(Default)" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Group" = "FSFilter Content Screener"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xht]
"(Default)" = "htmlfile"

[HKCR\htmlfile\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 95 E2 63 50 1B 21 DB FE 87 ED 4F 03 7D 68 2D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCU\Software\Classes\https\shell]
"(Default)" = ""

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances\2345FsMon Instance]
"Altitude" = "265000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances]
"DefaultInstance" = "2345FsMon Instance"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKCU\Software\Classes\http\shell]
"(Default)" = ""

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKCR\.shtml]
"(Default)" = "htmlfile"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.htm]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"DependOnService" = "FltMgr,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCR\.htm]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances\2345FsMon Instance]
"Flags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\htmlfile\shell]
"(Default)" = ""

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "htmlfile"

[HKCR\ftp\shell]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKCR\.xht]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"ErrorControl" = "1"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Type" = "2"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Start" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2345SafeTray" = "%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe /notify_autorun"

The process 2345ShellPro.exe:480 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 66 7A E5 42 B6 3A 09 75 2D 5A B2 20 20 C8 C4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process ºÇºÇ.exe:1316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 FF 9B 40 BD 4D BA ED 71 BE C5 C4 6D 9C C3 7D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448]
"2345pcsafe_k1742288.exe" = "2345安全卫士 v1.3 安装程序"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 2345softmgr_setup.exe:1888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 1A ED 38 5A FD B0 98 F9 17 DC 9C 20 4F 37 D6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"DisplayVersion" = "v1.3"
"DisplayIcon" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"Publisher" = "2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345SoftMgr]
"statID" = "100010"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"DisplayName" = "2345软件管家"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345SoftMgr]
"Value4" = "setup"
"Path" = "%Program Files%\2345Soft\2345SoftMgr"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345SoftMgr.exe]
"Path" = "%Program Files%\2345Soft\2345SoftMgr"

[HKLM\SOFTWARE\2345SoftMgr]
"Value" = "000014013710301064106251560402"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345SoftMgr.exe]
"(Default)" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"URLInfoAbout" = "http://safe.2345.com"
"UninstallString" = "%Program Files%\2345Soft\2345SoftMgr\Uninstall.exe"

[HKLM\SOFTWARE\2345SoftMgr]
"Value3" = "000030462524000715611146"

The process 2345SafeSvc.exe:408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E CF DD 3B 44 33 CE DD 03 0D 7C 33 E2 C1 5D D4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The process 2345pcsafe_k1742288.exe:1488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 96 D6 BE 36 32 68 C0 75 05 36 AE CF BB 5C 3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe]
"statID" = "100010"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345MPCSafe.exe]
"(Default)" = "%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"UninstallString" = "%Program Files%\2345Soft\2345PCSafe\Uninstall.exe"

[HKLM\SOFTWARE\2345PCSafe]
"Value" = "000064013610305064306251620402"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayIcon" = "%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe"
"URLInfoAbout" = "http://safe.2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"Publisher" = "2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345MPCSafe.exe]
"Path" = "%Program Files%\2345Soft\2345PCSafe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe]
"Path" = "%Program Files%\2345Soft\2345PCSafe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayVersion" = "v1.3"

[HKLM\SOFTWARE\2345PCSafe]
"Value3" = "000030462524000656236146"
"Value4" = "k1742288"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayName" = "2345安全卫士"

Dropped PE files

MD5	File path
dce7d48a8c0a9fd476852b61dc90c914	c:\Program Files\2345Soft\2345PCSafe\2345AvCloudQuery.dll
7ada1aa95a475aec1fdb9b8f85c1cdfc	c:\Program Files\2345Soft\2345PCSafe\2345AvScan.dll
2a5a893a99e8e35f0948574ef2b4452b	c:\Program Files\2345Soft\2345PCSafe\2345AvScan.exe
c61ade229c590559073920f9baf0d1bd	c:\Program Files\2345Soft\2345PCSafe\2345AvScanEngine.dll
ea6d0b74884a62162b18264d8118054b	c:\Program Files\2345Soft\2345PCSafe\2345BrowserDl.exe
5dcdfa64ecedf33435f0c07c9461e43d	c:\Program Files\2345Soft\2345PCSafe\2345ExtShell.exe
615039ca9040e2e940e992db88aadd14	c:\Program Files\2345Soft\2345PCSafe\2345FsMon.dll
3592ad7351492b0f4ce37f9b870382e8	c:\Program Files\2345Soft\2345PCSafe\2345GlobalData.exe
6be1d28c73388e436bbc505a8f83ca4f	c:\Program Files\2345Soft\2345PCSafe\2345InstallerPowerApi.dll
1315cc886b9ef82e9903e1fd279e5a87	c:\Program Files\2345Soft\2345PCSafe\2345MPCSafe.exe
1276684ef9a07bc5fe9d484b0f31a8da	c:\Program Files\2345Soft\2345PCSafe\2345NetMon.dll
30bebbbf935823a0e37eacd7f271f67c	c:\Program Files\2345Soft\2345PCSafe\2345ProcessApi.dll
602c4634e5a9587b072d487c6f8dea0d	c:\Program Files\2345Soft\2345PCSafe\2345RTProtect.exe
31aeac66cae0a2992b9e2ba4a2a40354	c:\Program Files\2345Soft\2345PCSafe\2345RegMon.dll
70998c5b378ac5eb866f1845fa617f38	c:\Program Files\2345Soft\2345PCSafe\2345SFBase.dll
ecd184ed23021cf77c90972ef9f9dad0	c:\Program Files\2345Soft\2345PCSafe\2345SFEMon.dll
7999833b416dc0eb681c468e86bdd06d	c:\Program Files\2345Soft\2345PCSafe\2345SFGuard.exe
a19965e32e6d293f9b4cd6ec78f1a146	c:\Program Files\2345Soft\2345PCSafe\2345SFWebMon.dll
a964af474ad6e692ba4375f63bef926b	c:\Program Files\2345Soft\2345PCSafe\2345SFWebShell.exe
40595f6fdc6f68eec61035de064171e8	c:\Program Files\2345Soft\2345PCSafe\2345SafeDB.dll
f999f032ce0233a82222f4589ccbfcdd	c:\Program Files\2345Soft\2345PCSafe\2345SafeDispatcher.dll
a22a276cbeaa5d999472d37a010b685f	c:\Program Files\2345Soft\2345PCSafe\2345SafeExam.dll
259dd9dedbe97662e65308f21d0ee3b2	c:\Program Files\2345Soft\2345PCSafe\2345SafeExt.dll
e0d6ef18f13808abf406baf7c27bb32f	c:\Program Files\2345Soft\2345PCSafe\2345SafeGarbage.dll
4671f6daf0d8f383cfc30f9c8a5ec488	c:\Program Files\2345Soft\2345PCSafe\2345SafeHotfix.dll
f23e4df7322d182e2ae92176bcfa5db4	c:\Program Files\2345Soft\2345PCSafe\2345SafeNotify.exe
5afae7885d50dc2e9eb3ebf43bd3f2df	c:\Program Files\2345Soft\2345PCSafe\2345SafeOptimize.dll
9c4400026c2616cba6737ab82b8d5493	c:\Program Files\2345Soft\2345PCSafe\2345SafeService.dll
8d3488370b000e47be1d937d631e766b	c:\Program Files\2345Soft\2345PCSafe\2345SafeSvc.exe
72a19832ffb845bcbfd29282836b4a8b	c:\Program Files\2345Soft\2345PCSafe\2345SafeTray.exe
f9fb0bb1aaead04fc4aa997651e65dcb	c:\Program Files\2345Soft\2345PCSafe\2345SafeUpdate.dll
f6c442fbb42bfb961c1f712fa98ed39f	c:\Program Files\2345Soft\2345PCSafe\2345SafeUtils.exe
bee83e7059ae697ca3d1166f0adc6624	c:\Program Files\2345Soft\2345PCSafe\2345ShellPro.exe
8eafe88bfffc6474522f39609dd384b8	c:\Program Files\2345Soft\2345PCSafe\2345softmgr_setup.exe
08180dfbcc3f0b1b1949c182bce91cb8	c:\Program Files\2345Soft\2345PCSafe\Uninstall.exe
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files\2345Soft\2345PCSafe\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files\2345Soft\2345PCSafe\msvcr110.dll
a5cb58df6e8a1ed88444727c17092c0a	c:\Program Files\2345Soft\2345PCSafe\sqlite3.dll
c5d262f524cdf51281d170f3608e6bb5	c:\Program Files\2345Soft\2345SoftMgr\2345SafeDB.dll
b4efc3b5e61f27ff32564367db16a2a4	c:\Program Files\2345Soft\2345SoftMgr\2345SafeDispatcher.dll
0bfceae14f3854825a867aa21a85fb6f	c:\Program Files\2345Soft\2345SoftMgr\2345SafeUpdate.dll
1ead602859be67338fa49cfe0cc2b12a	c:\Program Files\2345Soft\2345SoftMgr\2345SoftBox.dll
a7d580b981f107746866ad79da40d56f	c:\Program Files\2345Soft\2345SoftMgr\2345SoftInstaller.exe
9a4caff868707d9d91f1a3038f860bdb	c:\Program Files\2345Soft\2345SoftMgr\2345SoftLib.dll
11c515f3030958d4b43af0209315ce7e	c:\Program Files\2345Soft\2345SoftMgr\2345SoftLocal.dll
7e4ebfcbc0a2f3c34db7d9ddac47b3d1	c:\Program Files\2345Soft\2345SoftMgr\2345SoftMgr.exe
31b2b65857bcccdff2b004fdcbaf51cc	c:\Program Files\2345Soft\2345SoftMgr\2345SoftMgrDB.dll
7ad94de6cccc5cc18285fab72545c018	c:\Program Files\2345Soft\2345SoftMgr\2345SoftService.dll
434d2d8384fc88c69876ef70a957a663	c:\Program Files\2345Soft\2345SoftMgr\2345SoftSvc.exe
c17579aed7f9afc94b1cf6080eadc558	c:\Program Files\2345Soft\2345SoftMgr\2345SoftUninstall.dll
c74cffef401d363d0e239181b91cfd93	c:\Program Files\2345Soft\2345SoftMgr\2345SoftUtils.dll
7605d589832298e052fc009e22a32f96	c:\Program Files\2345Soft\2345SoftMgr\2345softNotify.exe
2ac7adfcdff51bd4345a0d83ac7e62dd	c:\Program Files\2345Soft\2345SoftMgr\Uninstall.exe
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files\2345Soft\2345SoftMgr\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files\2345Soft\2345SoftMgr\msvcr110.dll
a5cb58df6e8a1ed88444727c17092c0a	c:\Program Files\2345Soft\2345SoftMgr\sqlite3.dll
5b4a9db21fd3def72bbaf8e7fece560b	c:\WINDOWS\system32\drivers\2345FsMon.sys
818981c7bf0a18c8d58909dd6b8ce908	c:\WINDOWS\system32\drivers\2345NetMon.sys
eb5148236c798d4d41c8743bd8702c69	c:\WINDOWS\system32\drivers\2345PowerApi.sys
8b509ab090266ab8c0c8e741e8c533ee	c:\WINDOWS\system32\drivers\2345RegMon.sys
92d0a9c3cd68488f44b17cdb0ec9c368	c:\³ÉÆ·.exe
c4a1a359b052368506693d2dc232d4b7	c:\ºÇºÇ.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\drivers\2345FsMon.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Using the driver "UNKNOWN" the Trojan controls operations with a system registry by installing the registry notifier.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   ³ÉÆ·.exe:1908
   2345SFGuard.exe:2368
   2345SoftSvc.exe:136
   2345RTProtect.exe:2136
   2345AvScan.exe:2092
   2345AvScan.exe:2236
   2345AvScan.exe:552
   2345SoftMgr.exe:1948
   2345SoftMgr.exe:1548
   2345SoftMgr.exe:588
   2345SoftMgr.exe:228
   2345ExtShell.exe:1164
   2345ExtShell.exe:244
   2345ShellPro.exe:1128
   2345ShellPro.exe:460
   2345ShellPro.exe:480
   ºÇºÇ.exe:1316
   2345softmgr_setup.exe:1888
   2345SafeSvc.exe:408
   2345pcsafe_k1742288.exe:1488

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (1808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EK21GOA4\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LARCTEJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\2345PCSafe\config\exam.ini (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WP2Z412Z\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CX67KLI7\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#D.tmp (1269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#10.tmp (1573 bytes)
   %Documents and Settings%\%current user%\Favorites (4 bytes)
   %Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (4 bytes)
   %Documents and Settings%\%current user%\Application Data\2345AntiVirus\rccfginfo.tmp (29 bytes)
   %WinDir% (8 bytes)
   C:\$Directory (2980 bytes)
   %Program Files%\Windows NT (4 bytes)
   %System% (2672 bytes)
   %Program Files%\2345Soft\2345PCSafe (96 bytes)
   %Program Files%\2345Soft\2345SoftMgr (4 bytes)
   %System%\config (4 bytes)
   %Documents and Settings%\%current user%\Application Data\2345AvScan\2345MonCfg.data (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat.tmp (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#16.tmp (1541 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#11.tmp (1269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#15.tmp (1541 bytes)
   %Documents and Settings%\%current user%\Application Data\2345PCSafe\2345UpdateConfig.ini (687 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#12.tmp (1397 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#13.tmp (1541 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#14.tmp (1541 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#E.tmp (197 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
   %Documents and Settings%\%current user%\Start Menu\2345软件管家.lnk (1 bytes)
   %Documents and Settings%\%current user%\Desktop\2345软件管家.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#B.tmp (197 bytes)
   %Documents and Settings%\%current user%\Application Data\2345SoftMgr\config\softmgr (29 bytes)
   %Documents and Settings%\%current user%\Start Menu\强力卸载电脑中的软件 .lnk (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
   C:\ºÇºÇ.exe (85707 bytes)
   C:\³ÉÆ·.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#A.tmp (997 bytes)
   %System%\config\SYSTEM.LOG (12371 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#7.tmp (485 bytes)
   %System%\drivers\2345FsMon.sys (55 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#8.tmp (725 bytes)
   %System%\config\system (5919 bytes)
   %System%\drivers\2345NetMon.sys (28 bytes)
   %Documents and Settings%\%current user%\Application Data\2345PCSafe\2345Config.data (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RS#9.tmp (885 bytes)
   %System%\drivers\2345RegMon.sys (90 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
   %Documents and Settings%\%current user%\Desktop\2345安全卫士.lnk (1 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (84488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HZ~C.tmp.bat (84 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softuninstall.ico (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (3754 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (239 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SafeDispatcher.dll (2321 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftLocal.dll (4545 bytes)
   %Program Files%\2345Soft\2345SoftMgr\sqlite3.dll (3361 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (1808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (15021 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SafeUpdate.dll (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (92 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (3883 bytes)
   %Program Files%\2345Soft\2345SoftMgr\msvcr110.dll (6316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (1703 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (1723 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (1703 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (239 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftUtils.dll (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (3744 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftUninstall.dll (4545 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftBox.dll (15799 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345softNotify.exe (3361 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftMgrDB.dll (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (3883 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (1859 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftSvc.exe (1281 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftLib.dll (2321 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (334176 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345font (8184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (1650 bytes)
   %Program Files%\2345Soft\2345SoftMgr\Uninstall.exe (3910 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (134 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (3744 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softupdateremind.ico (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (6316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (1723 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softclass.dat (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (262 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftInstaller.exe (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (262 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SafeDB.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (4992 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe (32873 bytes)
   %Program Files%\2345Soft\2345SoftMgr\msvcp110.dll (1816 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\defaultsoft.ico (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (235 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (15021 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss5.tmp (363999 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (1816 bytes)
   %Program Files%\2345Soft\2345SoftMgr\2345SoftService.dll (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (3754 bytes)
   %Program Files%\2345Soft\2345PCSafe\sqlite3.dll (1808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (24832 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (129 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeUpdate.dll (213 bytes)
   %Program Files%\2345Soft\2345PCSafe\msvcp110.dll (1816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (7386 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\optimize.dat (34773 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (141 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345ExtShell.exe (2105 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SFGuard.exe (5441 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe (12287 bytes)
   %Program Files%\2345Soft\2345PCSafe\Uninstall.exe (16877 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\exam.dat (4992 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\fsmon.dat (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (3737 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (3845 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (175 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\trash.dat (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (137 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SFEMon.dll (192 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeUtils.exe (7726 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345ProcessApi.dll (25 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345AvCloudQuery.dll (315 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (214 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeOptimize.dll (1671 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (213 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeSvc.exe (1281 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeExam.dll (9606 bytes)
   %System%\drivers\2345PowerApi.sys (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (1628 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345RTProtect.exe (18248 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (6316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (870976 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeDispatcher.dll (1706 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeService.dll (137 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SFBase.dll (164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (132 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\bwinfo.dat (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (98 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\system64.dat (58402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (9606 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll (175 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SFWebMon.dll (229 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345ShellPro.exe (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (286 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SFWebShell.exe (601 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\TurnOffSoft.dat (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (25429 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\system.dat (95827 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345AvScan.exe (601 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeGarbage.dll (7972 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe (69512 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345AvScan.dll (294 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\office64.dat (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (1628 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345InstallerPowerApi.dll (32 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeDB.dll (127 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345FsMon.dll (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (1625 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345GlobalData.exe (13122 bytes)
   %Program Files%\2345Soft\2345PCSafe\msvcr110.dll (6316 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345NetMon.dll (132 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeNotify.exe (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (3737 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345AvScanEngine.dll (208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (246 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345RegMon.dll (286 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345SafeHotfix.dll (7972 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345BrowserDl.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (34007 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (4992 bytes)
   %Program Files%\2345Soft\2345PCSafe\2345softmgr_setup.exe (26831 bytes)
   %Program Files%\2345Soft\2345PCSafe\Data\office.dat (26688 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (1816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (32 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "2345SoftMgr" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe --type=start_service"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "2345SafeTray" = "%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe /notify_autorun"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	738299	741376	4.54952	e30151658afcf3940cc3a7a2f1d16668
.rdata	745472	15203502	15204352	5.38604	e2519a6371ac9ed0989c761d5e787a3c
.data	15949824	405962	131072	3.8332	de184fe7db95638b0c253275900424ed
.rsrc	16359424	30024	32768	3.37002	a9553dca99210e69317efe2b85182e7d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://db.safe.2345.com/query.php	183.136.203.31
hxxp://update.antivirus.2345.com/dbupdate/check.php	221.228.75.139

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /query.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Cookie: dict=fofedfdskdwdjmjwkfsmf1ifs3lco7fk;sid=k4e3g7nrn0kb6plgiuv9ij7mt7;PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7;

Host: db.safe.2345.com

Content-Length: 494

Cache-Control: no-cache

type=query&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=Z8c27N5f65d9d6904cjMkBjZmRTOlNmNmdjY4AjYidTYwgTNlZmMzYTZykjZkNmMjdjY5MzM0UD3lNje&sid=k4e3g7nrn0kb6plgiuv9ij7mt7&key=N540aY1000f7b754||wY4MmZihjMlJWZhVGOzQGMmRWNjBzNlNWNxEGOkJTNmVmMkRDZ5ITN2AzMjFTN1IDM1QWNxEDZ3ITNlJ2ezEGe&check_sum=M43feNec13462d3d|kDOiJWM5YTM0QjYxkDOwQWN3AjY1gjNihzN1MG4xIGd&md5=Yc465M5158de6f2d||wWptnI6QmIiADL10GZiIiOiBTNwEDMkZGOwQ2NidzM3YGZlJ2MkRjNzATZkZTYiAzYzxiIllmezIiO1IjMdZTflpQZlZjM0MGM0Y2YxETZiZTZ3gTYhBzYhhjY1AzfjBjc

HTTP/1.1 200 OK

Date: Sun, 09 Aug 2015 00:41:48 GMT

Server: Apache

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: dict=kk0mwfjekzjd0sofdfdfdwllffo1vndf; path=/

Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:48 GMT

Content-Length: 144

Content-Encoding: none

Content-Transfer-Encoding: binary

Connection: close

Content-Type: text/json;charset='UTF-8'

==Qfd1InxIiOimwciwiIoijIuRnsIAjOiQaWis3W6SIek9mYwiSfiUmzNYTdcBNz1YTdcGVZ2UTdRcDZmhTcdZWOyUdTcBTMyTYdcJiOci2ctJCiLM0QVNIl6Iyc1XRY0NnIp7jIkFWoZJye..

POST /query.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Cookie: dict=kk0mwfjekzjd0sofdfdfdwllffo1vndf;sid=k4e3g7nrn0kb6plgiuv9ij7mt7;PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7;

Host: db.safe.2345.com

Content-Length: 31818

Cache-Control: no-cache

type=query&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=Nc167Y2406255bba4cjMkBjZmRTOlNmNmdjYzAjYlZWZ2YzMjJzMiZjZ4EDOkF2NhV2YwYWY3Aj15gTd&sid=k4e3g7nrn0kb6plgiuv9ij7mt7&key=Nd157O24b3395fcb||gN5AjY4QDO3Y2NxQGZ3EWN3gTO3ETZjdTOlFmNyMWO3QWMkRzNhVTZhVmYyYTZ2EGZ1ADN2EGN1AzMyQT8zgDf&check_sum=N3ae1M86f9ae80dc|UTZ1kzYmRzYlVmY0IjN1EmZxImYmVjYyQGZ0Ej81Iza&md5=O6bf4N7cf86bcbeb||wWptnI6QmIiADL10GZiIiOkJzNklTZihzY2gjYxIDZhVGM1gTZlF2YmZzYlVjMiIjZzxiIllme3IiOwAjN9RDOiwyeikGZsoTMkJSb6UjI2ISMmFDOkNjN3QjZjZmNlN2YlJ2M0UGN5IWYlVjYjhTNiICL6NXa6UmIzITO2MzN71HLkJSayIiOtxiIiQWNipjI1ATMxIWOkNDN3EGZ5UmMkV2N2IDZmJWN4UzYmNmMsMmIpJycioXZ4ojM4UTMsQTfptnI6QmIiMDL10GZiIiOmRjM0EjZhNGMwYmYxgDN1ATZyYGMiRGNlFzM2ImYiIzMzxiIllme1IiOzIzNsYTfptnI6QmIiQDL10GZiIiO2ImMzIWMmVjZ5EjYwYmNzMWOihDO3QTY2QWMwYmNiAjYzxiIllme1IiO1cDO9ZDMiwyeikGZsoTNkJSb6UjIxICMmJDZ4MTNiNWZyEWYjNTY2ImMyQGO3AzNwgjM3gTMiICL6NXa6UmIwIjM9FjNiwyeikGZsojNkJSb6UjIhJiY4IGN1kTYyYWZyYjZjRGMwkTM3MmZ3EmZjVGNyYWOiICL6NXa6UmI3YTMyQzN71HLkJSa3IiOtxiIiQWNipjI5kzNkRWO4EzYzAzNyQWY3ETYwYGO1MDNwY2MxYTYsQmIpJycioXZ4oTNwQzNsQTfptnI6QmIigDL10GZiIiOhJGZ3EmZklDZmZzM0ETO0QzMxQ2M0E2NiJWOiJGOiczNzxiIllme1IiOwkTO9RDMiwyeikGZsoTOkJSb6UjIjJiZxYWY1MWNxkzNyM2YkJTOzMTNhJ2MhFTNkN2Y1kTOiICL6NXa6UmI2IzN9RDOiwyeikGZwoTMtxiIiQWN5ojIjNmZjJ2MkF2MihzMhRTZzEWMwMjZ0YDNj

HTTP/1.1 200 OK

Date: Sun, 09 Aug 2015 00:41:49 GMT

Server: Apache

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: dict=kajjqqsfvflwffdq8sjkdkf4sjs9djw0; path=/

Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:50 GMT

Content-Length: 13456

Content-Encoding: none

Content-Transfer-Encoding: binary

Connection: close

Content-Type: text/json;charset='UTF-8'

91VfAijI6ICybJCLiIOii4GdiiwN0MjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL1Qz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsQNDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywM0MjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLyQz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsENDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwM0MjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL5Mz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsUMzzojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwOyMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL4Ez6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsUMTzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywMxMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLyEz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsAMTzojIkmlI7xSfAijI6ICybJCLiIOii4GdiSwOwMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL2Az6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsQMDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywMwMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL5gj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIscODyojIkmlI7xSfAijI6ICybJCLiIOii4GdiiwN4IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL1gj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsQODyojIkmlI7xSfAijI6ICybJCLiIOii4GdiywM4IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLygj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsEODyojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwO3IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL3cj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsUNzyojIkmlI7xSfAijI6ICybJCLiIOii4GdiywM3IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLycj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsANzyojIkmlI7xSfAijI6ICybJCLiIOii4GdiSwO2IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL4Yj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsgNDyojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwM0IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL5Mj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsgMzyojIkmlI7xSfEijI6ICybJCLiIOii4GdiCwM2MjOQiWaisH9LJSMioIjsJnIsiII6IibJ0CL5Uz6MICZpJeys0nI

<<< skipped >>>

POST /dbupdate/check.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.8888.8888;)

Host: update.antivirus.2345.com

Content-Length: 39

Cache-Control: no-cache

pid=2345AntiVirus&type=monitorcfg&ver=0

HTTP/1.1 200 OK

Date: Sun, 09 Aug 2015 00:41:50 GMT

Server: Apache

Cache-Control: max-age=0

Expires: Sun, 09 Aug 2015 00:41:50 GMT

Vary: Accept-Encoding

Content-Length: 0

Content-Type: text/html; charset=gbk

HTTP/1.1 200 OK..Date: Sun, 09 Aug 2015 00:41:50 GMT..Server: Apache..Cache-Control: max-age=0..Expires: Sun, 09 Aug 2015 00:41:50 GMT..Vary: Accept-Encoding..Content-Length: 0..Content-Type: text/html; charset=gbk..

POST /query.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: db.safe.2345.com

Content-Length: 130

Cache-Control: no-cache

type=login&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=N8293Y81f94822844cjMkBjZmRTOlNmNmdjYzAzYlNmN5MWOwMWYiFmMyIDZzgzYygjZwgTYkVzbjVGf

HTTP/1.1 200 OK

Date: Sun, 09 Aug 2015 00:41:47 GMT

Server: Apache

Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: dict=fofedfdskdwdjmjwkfsmf1ifs3lco7fk; path=/

Set-Cookie: sid=k4e3g7nrn0kb6plgiuv9ij7mt7

Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:47 GMT

Content-Length: 68

Content-Encoding: none

Content-Transfer-Encoding: binary

Connection: close

Content-Type: text/json;charset='UTF-8'

==QfsxWudpjI5Rb2iJCL9Gxb15mOci2ctJCiLM0QVNIl6Iyc1XRY0NnIp7jIkFWoZJye..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1772:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

kernel32.dll

kernel32.dll

ole32.dll

ole32.dll

GdiPlus.dll

GdiPlus.dll

%S4WD

%S4WD

hg%fpM

hg%fpM

S.Ac9SR

S.Ac9SR

0.I%3s

0.I%3s

,wAe.kI

,wAe.kI

aiUy'4xu

aiUy'4xu

%c*@j

%c*@j

.eH'y

.eH'y

{&%U)

{&%U)

lj%4U

lj%4U

xe%CNs

xe%CNs

9F.cLe

9F.cLe

hJK.ZH

hJK.ZH

O.qt0

O.qt0

KERNEL32.DLL

KERNEL32.DLL

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

MSIMG32.dll

MSIMG32.dll

MSVCRT.dll

MSVCRT.dll

MSVFW32.dll

MSVFW32.dll

USER32.dll

USER32.dll

SkinH_EL.dll

SkinH_EL.dll

hXXp://VVV.jiuhuabuy.com/biaoge/930/877265/

hXXp://VVV.jiuhuabuy.com/biaoge/930/877265/

hXXp://qb123456.com/hx

hXXp://qb123456.com/hx

413188828

413188828

70162287

70162287

hXXp://e.3600gz.cn

hXXp://e.3600gz.cn

hXXp://VVV.3600gz.cn

hXXp://VVV.3600gz.cn

hXXp://VVV.3600gz.cn/forumdisplay.php?fid=61

hXXp://VVV.3600gz.cn/forumdisplay.php?fid=61

hXXp://VVV.3600gz.cn/viewthread.php?tid=1177

hXXp://VVV.3600gz.cn/viewthread.php?tid=1177

VVV.3600gz.cn

VVV.3600gz.cn

VVV.VVV.3600gz.cn.cn

VVV.VVV.3600gz.cn.cn

{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

t.Jt&

t.Jt&

.mixcrt

.mixcrt

mscoree.dll

mscoree.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

operator

operator

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

RegCreateKeyExW

RegCreateKeyExW

RegCloseKey

RegCloseKey

e:\SVN\rczip\bin\Win32\release\pdb\HaoZip7zSetup.pdb

e:\SVN\rczip\bin\Win32\release\pdb\HaoZip7zSetup.pdb

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

SHELL32.dll

SHELL32.dll

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

KERNEL32.dll

KERNEL32.dll

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

.?AVRCPasswordDlg@RC@@

.?AVRCPasswordDlg@RC@@

.?AV?$IUnknownImpl2@VIExtractCallbackUI@RC@@VICryptoGetTextPassword@2@@RC@@

.?AV?$IUnknownImpl2@VIExtractCallbackUI@RC@@VICryptoGetTextPassword@2@@RC@@

.?AVICryptoGetTextPassword@RC@@

.?AVICryptoGetTextPassword@RC@@

.?AV?$IUnknownImpl4@VIArchiveOpenCallback@RC@@VIArchiveOpenVolumeCallback@2@VIArchiveOpenSetSubArchiveName@2@VICryptoGetTextPassword@2@@RC@@

.?AV?$IUnknownImpl4@VIArchiveOpenCallback@RC@@VIArchiveOpenVolumeCallback@2@VIArchiveOpenSetSubArchiveName@2@VICryptoGetTextPassword@2@@RC@@

.?AV?$IUnknownImpl5@VIArchiveExtractCallback@RC@@VICryptoGetTextPassword@2@VIMtCompressProgressInfo@2@VIAskOverwrite@2@VISetSequentialInArchive@2@@RC@@

.?AV?$IUnknownImpl5@VIArchiveExtractCallback@RC@@VICryptoGetTextPassword@2@VIMtCompressProgressInfo@2@VIAskOverwrite@2@VISetSequentialInArchive@2@@RC@@

.?AVICryptoSetPassword@RC@@

.?AVICryptoSetPassword@RC@@

.?AV?$IUnknownImpl2@VICompressFilter@RC@@VICryptoSetPassword@2@@RC@@

.?AV?$IUnknownImpl2@VICompressFilter@RC@@VICryptoSetPassword@2@@RC@@

.?AV?$IUnknownImpl11@VICompressCoder@RC@@VICompressSetInStream@2@VISequentialInStream@2@VICompressSetOutStream@2@VISequentialOutStream@2@VIOutStreamFlush@2@VICryptoSetPassword@2@VICompressSetCoderProperties@2@VICompressWriteCoderProperties@2@VICryptoResetInitVector@2@VICompressSetDecoderProperties2@2@@RC@@

.?AV?$IUnknownImpl11@VICompressCoder@RC@@VICompressSetInStream@2@VISequentialInStream@2@VICompressSetOutStream@2@VISequentialOutStream@2@VIOutStreamFlush@2@VICryptoSetPassword@2@VICompressSetCoderProperties@2@VICompressWriteCoderProperties@2@VICryptoResetInitVector@2@VICompressSetDecoderProperties2@2@@RC@@

zcÁ

zcÁ

^^777>>79

^^777>>79

Çhh@cc7cc7@@cc9^>JO%%*'L?

Çhh@cc7cc7@@cc9^>JO%%*'L?

776:=7>}

776:=7>}

?!:::!!::!!::

?!:::!!::!!::

:!!&&!!:

:!!&&!!:

%C&%%GG

%C&%%GG

%**%%**%

%**%%**%

%&**%**%%&&

%&**%**%%&&

%**%*&%***

%**%*&%***

HaoZipPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD7z

HaoZipPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD7z

aMSG ^

aMSG ^

'ZAI.oq

'ZAI.oq

.dE0gw}

.dE0gw}

/"%8U

/"%8U

?.KC5H

?.KC5H

e.Q.tD

e.Q.tD

-p.iX

-p.iX

Y.QzT

Y.QzT

TW.kC

TW.kC

lQG.ta

lQG.ta

.iJu]/)

.iJu]/)

.Qy"5

.Qy"5

.uQvA

.uQvA

".xxK

".xxK

.ub& B

.ub& B

=Ð;

=Ð;

g[%Fu

g[%Fu

utõ

utõ

5

5

mzUdp?

mzUdp?

;R%X1

;R%X1

L%c!n

L%c!n

.nHnW

.nHnW

r0%St

r0%St

K.YhH

K.YhH

o?.PL

o?.PL

F%3sE

F%3sE

Y.wz'

Y.wz'

zdU.dd

zdU.dd

j{!.aB

j{!.aB

6q%SA

6q%SA

%UXk&

%UXk&

.gmQnl{

.gmQnl{

L.hP(

L.hP(

{u.Ct

{u.Ct

[DÜ

[DÜ

.xZn'_

.xZn'_

0^.zq

0^.zq

icuT%D|b

icuT%D|b

i 2uD.fz]

i 2uD.fz]

5uI.yS

5uI.yS

.LD$;

.LD$;

?.Lbt|SD

?.Lbt|SD

z.OJil

z.OJil

M.sqU

M.sqU

%xZBuk

%xZBuk

j%dkts

j%dkts

;-þ

;-þ

\xF.lz[@

\xF.lz[@

.VdN?

.VdN?

,.ov1

,.ov1

.CTs"

.CTs"

b.fE\

b.fE\

6%S""

6%S""

>.Vg#

>.Vg#

9SAÕ-

9SAÕ-

2A.Sn

2A.Sn

.Rre"`8u

.Rre"`8u

>.jE l"h

>.jE l"h

.ht(UR

.ht(UR

.FH

.FH

1:.xb

1:.xb

Cf.Ls;

Cf.Ls;

x$.Yne

x$.Yne

I*v.ovG _

I*v.ovG _

l.RYw

l.RYw

.Xd&/N

.Xd&/N

_.tR4#

_.tR4#

.izw#

.izw#

i.Bf[

i.Bf[

eBñu

eBñu

Qd.bE

Qd.bE

-Paw}

-Paw}

}.TPU]

}.TPU]

^k .Ka

^k .Ka

6&v%f:

6&v%f:

^t.cnc

^t.cnc

G.HI[

G.HI[

eO.Xm

eO.Xm

UEo.aA

UEo.aA

J-r}l

J-r}l

2.mo[RH

2.mo[RH

D*.NG^4

D*.NG^4

@.ssU

@.ssU

XTBKPY.sR

XTBKPY.sR

*.Kox,

*.Kox,

g.yVZ7

g.yVZ7

.syhaW

.syhaW

M(_R.Tg

M(_R.Tg

s.Pc%M

s.Pc%M

wV.Pp

wV.Pp

KDp".QrM|

KDp".QrM|

`.EL_

`.EL_

Kc.LL

Kc.LL

j#V.tt

j#V.tt

.gUF/

.gUF/

xNL%F

xNL%F

)D.na

)D.na

.pX=d=

.pX=d=

_Sz%C

_Sz%C

>s.jYbp

>s.jYbp

e%F}y

e%F}y

.kIrXs9

.kIrXs9

57?.yN

57?.yN

_Rz.xH

_Rz.xH

kb.De

kb.De

9V.HA

9V.HA

%fMeUh

%fMeUh

)I$.pvR

)I$.pvR

>%Ute4(L6

>%Ute4(L6

F.xm=

F.xm=

-U}7Q A=l(

-U}7Q A=l(

C~.LJ]

C~.LJ]

vS#%s

vS#%s

d{.pi

d{.pi

.hVPF

.hVPF

W3A"%S

W3A"%S

hE.nq9wtp

hE.nq9wtp

.Of)dY

.Of)dY

K}]%SbD

K}]%SbD

skpN%Fm

skpN%Fm

T.uHd

T.uHd

S0p3Tt%D

S0p3Tt%D

;%9UQ#

;%9UQ#

_3".iG

_3".iG