PUA.Win32.2345Soft.D

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• "%User Temp%\GSoInput_V10030.exe" /s
• "%User Temp%\ZipSetup10165.exe" /s
• "%User Temp%\setup_zgwxb021.exe" 14
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputUpdateSvr.exe" -i
• schtasks /delete /tn GSoInput{9055547F-25C8-4C19-AB57-629B7214A9D9} /F
• schtasks /create /tn GSoInput{9055547F-25C8-4C19-AB57-629B7214A9D9} /xml "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInput{9055547F-25C8-4C19-AB57-629B7214A9D9}.xml"
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe" /deploy
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe" /regskinfile
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe" /rebuildskinlistfile
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputSetup.exe" /i
• Cacls.exe "%Program Files%\GSoSoft\GSoInput" /T /E /G Everyone:F
• "%User Temp%\166rd992\setup_zgwxb021.exe" 14
• "%Program Files%\WorthyShop\Vectrya.exe" a3 --e79=zgwxb021200326
• %Program Files%\WorthyShop\Svnscr.exe 89
• "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputUpdateSvr.exe"
• "%Program Files%\WorthyShop\Vectrya.exe" 37 --0b7=0
• "%Program Files%\WorthyShop\SoftUpd.exe" 76
• "%Program Files%\WorthyShop\Mrecancy.exe" r176 --b4b=http://down.{BLOCKED}gshidai.com/gw/zg/zsw2.gif --9e2=1 --88e=1766ed152c565b2495f15b73f5129491
• "%Program Files%\WorthyShop\Mrecancy.exe" r176 --b4b=http://down.{BLOCKED}gshidai.com/gw/zg/zsj.gif --9e2=1 --88e=1766ed152c565b2495f15b73f5129491
• "%Program Files%\WorthyShop\Vectrya.exe" 6a --0b7=0
• "%Program Files%\WorthyShop\Vectrya.exe" 75
• "%Program Files%\WorthyShop\Donment.exe" da
• "%System%\regsvr32.exe" /s "%System%\GSoInput.dll"
• regsvr32.exe /s "%System%\GSoInput.dll"
• "%Program Files%\WorthyShop\Vectrya.exe" fe --696=Donment.exe

It creates the following folders:

• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b
• %User Profile%\AppData
• %Program Files%\WorthyShop
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476
• %AppDataLocal%Low\GSoInput
• %AppDataLocal%Low\BubblesPop
• %Program Files%\GSoSoft
• %AppDataLocal%Low\JP
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data
• %AppDataLocal%Low\GSoInput\build
• %AppDataLocal%Low\WindowPop
• %Program Files%\Common Files\WorthyShop
• %System Root%\Users
• %AppDataLocal%Low\WorthyShop\Config
• %AppDataLocal%Low\WorthyShop
• %Program Files%\GSoSoft\GSoInput
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\skin
• %AppDataLocal%Low\ZLSDPath
• %User Temp%\166rd992
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Potentially Unwanted Application registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WorthyShopV1
ImagePath = "%Program Files%\WorthyShop\Svnscr.exe 89"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\GSoInputUpdateSvr
ImagePath = "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputUpdateSvr.exe"

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• %User Temp%\uninstall.xml
• %AppDataLocal%Low\JP\jp.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It deletes the following folders:

• %User Temp%\nsw6789.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSinput
bind_flag = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
UninstallString = "%Program Files%\GSoSoft\GSoInput\uninst.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
DisplayIcon = "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
DisplayName = "\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
DisplayVersion = "1.0.0.3476"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
Publisher = "He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
InstallLocation = "%Program Files%\GSoSoft\GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\GSoInput
InstallPackageName = "GSoInput_V10030"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
AppPath = "%Program Files%\GSoSoft\GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
PID = "4ef8164712f6491c2848e861336987b5"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
uniqueId = "{7C9FF250-0DEE-4879-87DE-875A057E5215}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
UnionId = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
OEMUnionId = "8000"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
OemID = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
uid = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
Version = "100003476"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
InstallDir = "%Program Files%\GSoSoft\GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
{D473B033-3C58-44FB-8EE0-06EE6D53E4C9}
AppName = "\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
{D473B033-3C58-44FB-8EE0-06EE6D53E4C9}
KeyName = "GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
{D473B033-3C58-44FB-8EE0-06EE6D53E4C9}
AppPath = "%Program Files%\GSoSoft\GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
b7053 = "1000"

HKEY_LOCAL_MACHINE\SOFTWARE\TXlTb2Z0\
TVNTb2Z0\V29ydGh5U2hvcA==
b7053 = "1000"

HKEY_CURRENT_USER\Software\WorthyShop\
67b8d
2aee1 = "20191127"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
12ede = "0"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGPISet
ParName = "UnKonwsetup_zgwxb021.exe"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGPISet
ParSign = "Sichuan Zhiling Times Network Technology Co., Ltd."

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
InstallPath = "%Program Files%\WorthyShop"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
WorthyShop
InstallPath = "%Program Files%\WorthyShop"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
FileMD5 = "92ba95c5f3b9bc75f8bc385c6c24db12"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Compatibility Assistant\Persisted\%User Temp%\
166rd992
setup_zgwxb021.exe = "1"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGAppInfo
CfgPath = "%AppDataLocal%Low\WorthyShop"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
b7053 = "1001"

HKEY_LOCAL_MACHINE\SOFTWARE\TXlTb2Z0\
TVNTb2Z0\V29ydGh5U2hvcA==
b7053 = "1001"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop\
ZGAppInfo
QID = "zgwxb021200326"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGAppInfo
QID = "zgwxb021200326"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
83112 = "1"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
QID = "zgwxb021200326"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
1b2a3 = ""

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
c1098 = "1574880818"

HKEY_LOCAL_MACHINE\SOFTWARE\TXlTb2Z0\
TVNTb2Z0\V29ydGh5U2hvcA==
c1098 = "1574880818"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop\
ZGAppInfo
InstallTime = "1574880818"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
InstallTime = "1574880818"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop\
ZGAppInfo
FirstInstallTime = "1574880818"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
FirstInstallTime = "1574880818"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
92012 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
DisplayName = "\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b 1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
UninstallString = "%Program Files%\WorthyShop\Uninst.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
DisplayIcon = "%Program Files%\WorthyShop\Buy.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
DisplayVersion = "1.0.8.20228"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
Publisher = "\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\xe5\x80\
xbc\xe8\xb4\
xad\xe5\x8a\
xa9\xe6\x89\
x8b
URLInfoAbout = "http://www.{BLOCKED}gshidai.com/zg"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
61902 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
WorthyShop
ef811 = "WorthyShopV1"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
ef811 = "WorthyShopV1"

HKEY_LOCAL_MACHINE\SOFTWARE\WorthyShop
7084e = "%Program Files%\WorthyShop\Svnscr.exe 89"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
427ab = "20191127"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
ef8c1 = "1574880866"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
2ffa3 = "11"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
4fad1 = "44"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
2ffa3 = "-1"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
4fad1 = "-1"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
2b8f4 = "27"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\ZGSetting
4698c2cd18b95584b9dcdbcf01438710 = "1"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\FileMD5
72ffcb474d34e473864558d2ecf76925 = "5141782DBB2DEBA67EF1FFDDD3087293"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\Time
(Default) = "20191127"

HKEY_USERS\S-1-5-21-2407829820-1079796033-203259571-500\Software\
WorthyShop\FileMD5
86176fff3f94063826c8034fd13f8942 = "6CF9E32C432B9E9C2D9C10B8BF352C10"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGAppInfo
CfgPath = "%AppDataLocal%Low\WorthyShop"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
5d969 = "20191127"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
983da = "20191127"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
729ee = "20191127"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
2ffa3 = "13"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
4fad1 = "22"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
c73f6 = "20191127"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
73bfa = "20191127"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.hgs
(Default) = "GSoInputSkinFile"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile
(Default) = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile
EditFlags = "65536"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile\DefaultIcon
(Default) = "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe,0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile\Shell
(Default) = "Open"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile\Shell\Open
(Default) = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
GSoInputSkinFile\Shell\Open\
Command
(Default) = "%Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe %1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/GSoInputSkin
Extension = ".hgs"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "12"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Keyboard Layouts\E0200804
Ime File = "GSOINPUT.IME"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Keyboard Layouts\E0200804
Layout Text = "\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Keyboard Layouts\E0200804
Layout File = "kbdus.dll"

HKEY_CURRENT_USER\Software\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
Enable = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
Enable = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
WeaselRoot = "%Program Files%\GSoSoft\GSoInput\1.0.0.3476"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
GSoSoft\GSoInput
ServerExecutable = "GSoInputServer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}
(Default) = "GSoInput"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
InprocServer32
(Default) = "%System%\GSoInput.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}
Enable = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
Description = "\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
IconFile = "%System%\GSoInput.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
IconIndex = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CTF\TIP\{585847E5-6AE9-43D8-B7C8-58EFD6C2930D}\
LanguageProfile\0x00000804\{0106AA2D-7F7C-4F7B-86B4-723D3081C11E}
SubstituteLayout = "0xe0200804"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\ZGSetting
7422b = "20200326"

HKEY_USERS\.DEFAULT\SOFTWARE\
WorthyShop\OpenStatic
Donment.exe = "20191127"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
6fbdac1f498f92c0cc20793716d2fa8a = "1"

HKEY_CURRENT_USER\Software\WorthyShop\
ZGSetting
a5dafdfb96fa11093269d3d400e1a663 = "1"

HKEY_CURRENT_USER\Software\JP\
51ac4bf63a0c6a9cefa7ba69b4154ef1
946aacf9f15ba47cc0b79d0c93202a12 = "20191127"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WorthyShopV1
DisplayName = "WorthyShop Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WorthyShopV1
Start = "SERVICE_AUTO_START"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\GSoInputUpdateSvr
DisplayName = "GSoInputUpdateSvr"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\GSoInputUpdateSvr
Start = "SERVICE_AUTO_START"

It modifies the following registry entries:

HKEY_CURRENT_USER\Keyboard Layout\Preload
2 = "E0200804"

(Note: The default value data of the said registry entry is e00e0804.)

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %User Temp%\166rd992\setup_zgwxb021.exe
• %Program Files%\WorthyShop\Uninst.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\wubi86.reverse.bin
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\bugreport_server.ini
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\ivan_pinyin.reverse.bin
• %Program Files%\WorthyShop\Praiber64.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\skin\xe6\xa4\x8d\xe7\x89\xa9\xe7\x9a\xae\xe8\x82\xa4.hgs
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data
• %Program Files%\WorthyShop\Buy.exe
• %User Temp%\_20191127_185452
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\skin\xe5\x8d\xa1\xe9\x80\x9a\xe4\xba\xba\xe7\x89\xa9\xe7\x9a\xae\xe8\x82\xa4.hgs
• %AppDataLocal%Low\GSoInput\build\ivan_pinyin.schema.yaml
• %Program Files%\WorthyShop\Valrasor.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputServer.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputUpdateSvr.exe
• %Program Files%\WorthyShop\Buymn.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\wubi_pinyin.schema.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\rime.dll
• %User Temp%\_20191127_185452-shm
• %User Temp%\_20191127_185452-wal
• %User Temp%\ZipSetup10165.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputSetup.exe
• %Program Files%\WorthyShop\Svnscr.exe
• %Program Files%\WorthyShop\wke.dll
• %AppDataLocal%Low\GSoInput\installation.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\taurus.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\gsoinput.ime
• %Program Files%\WorthyShop\Onflness.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476
• %AppDataLocal%Low\ZLSDPath\zsj.gif
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\stroke.schema.yaml
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95\xe5\x8d\xb8\xe8\xbd\xbd \xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95.lnk
• %Program Files%\WorthyShop\Vectrya.exe
• %Program Files%\WorthyShop\Svcmpir.dll
• %Program Files%\WorthyShop\Constrive64.dll
• %Program Files%\WorthyShop\Svctoar.exe
• %AppDataLocal%Low\GSoInput\skin_list.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\ClientLogger.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\key_bindings.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\stroke.table.bin
• %AppDataLocal%Low\BubblesPop\CheckToTips.ini
• %Program Files%\WorthyShop\Valrasor64.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\bugreport.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\default.yaml
• %AppDataLocal%Low\WorthyShop\Config\zst.gif.temp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b.lnk
• %Program Files%\WorthyShop\Onflness64.dll
• %Program Files%\WorthyShop\SoftUpd.exe
• %AppDataLocal%Low\ZLSDPath\zsw2.gif
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\stroke.reverse.bin
• %Program Files%\WorthyShop\Donment.exe
• %AppDataLocal%Low\GSoInput\build\stroke.schema.yaml
• %AppDataLocal%Low\GSoInput\build\weasel.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\pinyin.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\punctuation.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\skin\xe5\x8d\xa1\xe9\x80\x9a\xe5\x8a\xa8\xe7\x89\xa9\xe7\x9a\xae\xe8\x82\xa4.hgs
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\Updater.exe
• %AppDataLocal%Low\JP\jp2.ini
• %Program Files%\WorthyShop\Mrecancy.exe
• %AppDataLocal%Low\GSoInput\build\wubi86.prism.bin
• %Program Files%\GSoSoft\GSoInput\upgrade.exe
• %User Temp%\GSoInput_V10030.exe
• %Program Files%\WorthyShop\Praiber.exe
• %AppDataLocal%Low\GSoInput\build\wubi_pinyin.schema.yaml
• %AppDataLocal%Low\GSoInput\build\wubi86.schema.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\ivan_pinyin.schema.yaml
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\wubi86.schema.yaml
• %System%\GSoInput.ime
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b\xe5\x8d\xb8\xe8\xbd\xbd.lnk
• %AppDataLocal%Low\GSoInput\build\stroke.prism.bin
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b\xe5\x9c\xa8\xe7\xba\xbf\xe5\x8d\x87\xe7\xba\xa7.lnk
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\wubi86.table.bin
• %Program Files%\WorthyShop\WorthyShop.ini
• %AppDataLocal%Low\GSoInput\user.yaml
• %User Temp%\bindconfig13.ini
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\weasel.yaml
• %User Temp%\WorthyShop-28786.7z
• %User Temp%\setup_zgwxb021.exe
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95\xe6\x9e\x81\xe9\x80\x9f\xe8\xbe\x93\xe5\x85\xa5\xe6\xb3\x95\xe8\xae\xbe\xe7\xbd\xae.lnk
• %Program Files%\WorthyShop\Constrive.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\gsoinputx64.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build
• %AppDataLocal%Low\GSoInput\build\wubi_pinyin.prism.bin
• %Program Files%\WorthyShop\Buyti.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\data\build\ivan_pinyin.table.bin
• %AppDataLocal%Low\ZLSDPath\zsj.gif.temp
• %AppDataLocal%Low\WorthyShop\Config\Use.ini
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\gsoinput.dll
• %Program Files%\GSoSoft\GSoInput\uninst.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\bugreport.ini
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\gsoinputx64.ime
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\bugreport64.exe
• %AppDataLocal%Low\GSoInput\build\default.yaml
• %Program Files%\GSoSoft\GSoInput\uninstall.xml
• %AppDataLocal%Low\GSoInput\build\ivan_pinyin.prism.bin
• %Program Files%\Common Files\WorthyShop\WorthyShop.ini
• %AppDataLocal%Low\WorthyShop\Config\zst.gif
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInput{9055547F-25C8-4C19-AB57-629B7214A9D9}.xml
• %System%\GSoInput.dll
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\GSoInputDeployer.exe
• %Program Files%\GSoSoft\GSoInput\1.0.0.3476\skin
• %System Root%\Users\Public\Desktop\xe5\x80\xbc\xe8\xb4\xad\xe5\x8a\xa9\xe6\x89\x8b.lnk
• %Program Files%\GSoSoft\GSoInput\RepairHelper.exe
• %AppDataLocal%Low\ZLSDPath\zsw2.gif.temp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

This report is generated via an automated analysis system.