Trojan.Win32.UPDLOADR.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• "%System%\cacls.exe" "%System Root%\Program Files\xt" /e /t /p everyone:f
• cacls.exe "%System Root%\Program Files\xt" /e /t /p everyone:f
• systeminfo
• "%User Temp%\MYi1nI.exe"
• %User Temp%\MYi1nI.exe
• wscript "%User Temp%\1.vbs""
• regedit /s "%User Temp%\1.reg"
• %User Temp%\2345pcsafe_807311.exe
• %User Temp%\2345Explorer_209411_silence.exe
• %System%\cmd.exe /c del "%User Temp%\MYi1nI.exe"
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe" --type=install --installtype=new --lockCheckState=1 --silent=1
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ExtShell64.exe" --install=AvShellExt64.dll
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe" --type=installstatic --installtype=new --usertype=UNION --silent=1 --preversion=0.0.0.0
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeCenter\2345SafeCenterInstaller.exe" --type=install --invoke_product=1 --path="%Program Files%\2345Soft\" --lockExplorerKB=0 --lockIEState=1 --lock3rdState=1 --lockBrowserState=1 --safe_override=0
• "%Application Data%\SoftMgr_2345\2345SoftMgr.exe" --shortcut=notify --from=s --entry=12 --package="%Application Data%\SoftMgr_2345\2345softmgr_v5.3.0.11631.7z" --nwinst=1
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe"
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe" --type=repair
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345Speedup.exe" --type=default
• "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345TrashRcmd.exe" --type=bootcount

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Application Data%\2345PCSafe
• %Application Data%\2345SoftMgr\stat
• %Application Data%\2345SoftMgr
• %Program Files%\2345Soft\2345PCSafe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631
• %Program Files%\2345Soft\2345Explorer
• %Application Data%\2345PCSafe\Update\download\0
• %Application Data%\SoftMgr_2345
• %Windows%\Temp\2345_Crashes
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SectionsBackup\SafeUpdate
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233
• %Program Files%\2345Soft\2345Explorer\Doctor
• %AppDataLocal%\2345Explorer\User Data\Default\Thumbnails
• %Application Data%\SoftMgr_2345\Application
• %Program Files%\2345Soft
• %Program Files%\2345Soft\2345Explorer\Locales
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data
• %Program Files%\2345Soft\2345Explorer\User Data\Default\Thumbnails
• %Program Files%\2345Soft\2345SafeCenter\CommonFiles\Config
• %Application Data%\2345SoftMgr\update\download\0
• %User Temp%\2345Explorer\2345Explorer_10
• %Start Menu%\Programs\2345\xe5\xae\x89\xe5\x85\xa8\xe4\xb8\xad\xe5\xbf\x83
• %Application Data%\2345SafeCenter\Data
• %Program Files%\2345Soft\2345SafeCenter
• %Program Files%\2345Soft\2345PCSafe\CommonFiles\Config
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\icon
• %Application Data%\2345SoftMgr\config
• %Application Data%\SoftMgr_2345\Application\Common\icon
• %Application Data%\2345PCSafe\Update\download
• %Program Files%\2345Soft\2345Explorer\Resource
• %Application Data%\2345SoftMgr\update
• %Program Files%\2345Soft\2345Explorer\Plugins
• %Program Files%\2345Soft\2345Explorer\User Data
• %Program Files%\2345Soft\2345Explorer\Protect
• %Program Files%\2345Soft\2345SafeCenter\CommonFiles
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover
• %Application Data%\SoftMgr_2345\Application\Common
• %Application Data%\2345AvScan
• %Program Files%\2345Soft\2345PCSafe\CommonFiles
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087
• %Application Data%\2345PCSafe\Update\InstalledFiles
• %Program Files%\2345Soft\2345Explorer\Extensions
• %Application Data%\2345PCSafe\ExPublic
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeCenter
• %AppDataLocal%\2345Explorer\User Data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data
• %Application Data%\2345SafeCenter\Update
• %AppDataLocal%\2345Explorer\User Data\Default\TempOnlinedata
• %User Temp%\2345PCSafe
• %Application Data%\2345SafeCenter
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\01
• %Program Files%\2345Soft\2345Explorer\Resource\AssocIcon
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data
• %Program Files%\2345Soft\2345Explorer\User Data\Default\Thumbnails\v1
• %AppDataLocal%\2345Explorer\User Data\Default\Thumbnails\v1
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SectionsBackup
• %Program Files%\2345Soft\2345Explorer\Swiftshader
• %AppDataLocal%\2345Explorer\User Data\Default
• %Application Data%\2345SafeCenter\Update\A002
• %Application Data%\2345PCSafe\Update
• %Program Files%\2345Soft\2345Explorer\User Data\Default
• %AppDataLocal%\2345Explorer
• %Application Data%\2345PCSafe\Config
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SoftMgr
• %AppDataLocal%\2345Explorer\User Data\Default\ExternalExtensions
• %Application Data%\2345SoftMgr\update\download
• %Program Files%\2345Soft\2345Explorer\Assistant
• %User Temp%\2345PCSafe\2345PCSafe_10
• %User Temp%\2345Explorer
• %User Temp%\chrome_upgrade

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\2345SafeSvc
ImagePath = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\2345SafeSvc
ImagePath = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe"

Other System Modifications

This Trojan modifies the following file(s):

• %Application Data%\2345SafeCenter\Data\ClickStat

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It deletes the following files:

• %Windows%\Temp\RC~C34F.tmp
• %Program Files%\2345Soft\2345SafeCenter\CommonFiles\Config\BTknitr
• %Program Files%\2345Soft\2345Installer\InstallCfg.data
• %Windows%\Temp\RC~C32F.tmp
• %Application Data%\SoftMgr_2345\Uninstall.exe.0.del

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It deletes the following folders:

• %Program Files%\2345Soft\2345Installer
• %User Temp%\nsm3BBA.tmp

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
MySQL AB\MySQL Connector/ODBC 3.51
Version = "3.51.24"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
ODBC\ODBCINST.INI\MySQL ODBC 3.51 Driver
UsageCount = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
ODBC\ODBCINST.INI\MySQL ODBC 3.51 Driver
Driver = "%System%\myodbc3.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
ODBC\ODBCINST.INI\MySQL ODBC 3.51 Driver
Setup = "%System%\myodbc3s.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
ODBC\ODBCINST.INI\ODBC Drivers
MySQL ODBC 3.51 Driver = "Installed"

HKEY_CURRENT_USER\Software\2345.com\
2345PCSafe
InstallBy = "{random characters}"

HKEY_CURRENT_USER\Software\2345.com\
2345PCSafe
UpgradeBy = ""

HKEY_CURRENT_USER\Software\2345.com\
2345PCSafe
UninstallBy = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Value1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Value2 = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Value = "000038003110312012179688240839"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Value6 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Value7 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345PCSafe
Path = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
DisplayName = "\xe5\xae\x89\xe5\x85\xa8\xe5\x8d\xab\xe5\xa3\xab - 2345"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
UninstallString = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
DisplayIcon = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345MPCSafe.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
DisplayVersion = "v5.6"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
URLInfoAbout = "http://safe.{BLOCKED}5.cc"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
Publisher = "2345.cc"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
2345MPCSafe.exe
(Default) = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345MPCSafe.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
2345MPCSafe.exe
Path = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087"

HKEY_CURRENT_USER\Software\2345.com
UUID = "02B7B48CA7A8973FBC392D9E3BDBF118 2466"

HKEY_CURRENT_USER\Software\2345.com\
2345Explorer
LADValue = "1591284540 1823"

HKEY_CURRENT_USER\Software\2345.com\
2345Explorer
ADValue = "{random characters}"

HKEY_CURRENT_USER\Software\2345.com\
2345Explorer
InstallBy = "{random characters}"

HKEY_CURRENT_USER\Software\2345.com\
2345Explorer
UpgradeBy = ""

HKEY_CURRENT_USER\Software\2345.com\
2345Explorer
UninstallBy = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = "221"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\2345SafeSvc
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\2345SafeSvc
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\2345SafeSvc
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\2345SafeSvc
ObjectName = "LocalSystem"

HKEY_CURRENT_USER\Software\2345.com\
2345SafeCenter
LADValue = "1591284540 1823"

HKEY_CURRENT_USER\Software\2345.com\
2345SafeCenter
ADValue = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Path = "%Program Files%\2345Soft\2345SafeCenter\5.12.3.8233"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
InstallSource = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
RunningMode = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Value2 = "13"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Value6 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Value7 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Value1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
2345SafeCenter
Value = "000098013210310017475688520839"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345SoftMgr
DisplayName = "\xe8\xbd\xaf\xe4\xbb\xb6\xe7\xae\xa1\xe5\xae\xb6 - 2345"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345SoftMgr
DisplayIcon = "%Application Data%\SoftMgr_2345\2345SoftMgr.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345SoftMgr
URLInfoAbout = "http://safe.{BLOCKED}5.cc"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345SoftMgr
Publisher = "2345\xe7\xa7\xbb\xe5\x8a\xa8\xe7\xa7\x91\xe6\x8a\x80"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345SoftMgr
UninstallString = "%Application Data%\SoftMgr_2345\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions\
Approved
{C4F75DB1-B9F4-425A-9F5B-778911BCF176} = "2345 PC Safe Shell Extension"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}
(Default) = "2345 PC Safe Shell Extension"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32
(Default) = "%Program Files%\2345Soft\2345PCSafe\5.6.0.12087\AvShellExt64.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shellex\ContextMenuHandlers\
2345PCSafe
(Default) = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
lnkfile\shellex\ContextMenuHandlers\
2345PCSafe
(Default) = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Directory\shellex\ContextMenuHandlers\
2345PCSafe
(Default) = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Folder\ShellEx\ContextMenuHandlers\
2345PCSafe
(Default) = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Drive\shellex\ContextMenuHandlers\
2345PCSafe
(Default) = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

HKEY_CURRENT_USER\Software\2345.com\
2345PCSafe
LADValue = "1591284566 1830"

HKEY_CURRENT_USER\Software\2345.com\
2345PCSafe
ADValue = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\2345PCSafe
Publisher = "2345\xe7\xa7\xbb\xe5\x8a\xa8\xe7\xa7\x91\xe6\x8a\x80"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\2345SafeSvc
DisplayName = "2345SafeSvc"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\2345SafeSvc
Start = "SERVICE_AUTO_START"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = "221"

(Note: The default value data of the said registry entry is 91.)

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
Local Settings\Software\Microsoft\
Windows\Shell\MuiCache\
%User Temp%\2345pcsafe_807311.exe

HKEY_CURRENT_USER\Software\Classes\
Local Settings\Software\Microsoft\
Windows\Shell\MuiCache\
%User Temp%\2345Explorer_209411_silence.exe

Dropping Routine

This Trojan drops the following files:

• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LeakFix.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAbib.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgrMain.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAB01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\msvcp120.dll
• %Program Files%\2345Soft\2345Explorer\courgette_dll.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\ProtectCenterUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeLockUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BB01.data
• %Application Data%\2345PCSafe\ExPublic\SafeReport
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ShortcutArrow.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftDataCenter.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeLock.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345PopupInpt.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SdAntiVBusCore.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\DriverInstall.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgrMenu.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ExtShell.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AJ01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAE01.data
• %Application Data%\2345PCSafe\Config\Speedup
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LSPFixUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BR01.data
• %Application Data%\2345SoftMgr\stat\softmgrinstallstat.lock
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BF01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AW01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeExpMon64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345NetFlow.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgrUn.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BH01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\01\64_2345SafeSvc.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAT01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345VirusScan.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345Extract.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AR01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBA01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftNotify.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AV01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterSvc.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\lua51.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdSMgrPlugin.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BC01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeTray.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\msvcr120.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Optimize.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgrMenu64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\FuncAssistant.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\NetFlowUI.dll
• %Program Files%\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAD01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\CA01.dat
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeUpdate.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345MiniUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\AvUpdate411.dat
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BO01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\ManuUpdate.dll
• %User Temp%\2345explorer_installer_statistics.time
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftUninstall.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\FileShreUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345PCSafeBootAssistant.exe
• %Program Files%\2345Soft\2345Explorer\d3dcompiler_47.dll
• %Program Files%\2345Soft\2345Explorer\chrome_elf.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeUpdateUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBB02.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BT01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345Base.data
• %Application Data%\2345SoftMgr\update\download\0\2345SoftMgr.NewVersion.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345NetRepair.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Exam.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\ProtectLogistics.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AQ01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdUIList.dll
• %Application Data%\SoftMgr_2345\2345Extract.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdHipsWebProtect.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345Misc.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeBaseMon.dll
• %Program Files%\2345Soft\2345Explorer\libegl.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAC01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBI01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Speedup.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\mfc120u.dll
• %Application Data%\2345SoftMgr\update\2345SoftMgr.CheckVersion.data
• %Application Data%\SoftMgr_2345\2345softmgr_v5.3.0.11631.7z
• %Windows%\Temp\2345_Crashes\operation_log.txt
• %Application Data%\2345SafeCenter\Data\StatusStat
• %Program Files%\2345Soft\2345Explorer\Swiftshader\libEGL.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdRtPopupInpt.dll
• %Application Data%\2345SafeCenter\Data\SafeCenterInstallRealTimeStat.time
• %AppDataLocal%\2345Explorer\User Data\Default\PreferencesV2
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdTrojaneEngine.dll
• %Program Files%\2345Soft\2345Explorer\coral_extract.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AC01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345LuaBizMgr.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeUpdate.exe
• %Application Data%\2345SoftMgr\config\commonData
• %Application Data%\2345PCSafe\Config\UsbGuard
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterInstaller.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\NetRepair.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345SafeCenterSvc.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\NetRepairUI.dll
• %Program Files%\2345Soft\2345Explorer\2345Explorer.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\PopupsMutex.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdTaskSysPlugin.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SysDoctorUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\01\86_2345SafeSvc.data
• %Application Data%\2345SafeCenter\Data\InstClick.lock
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345Prot.data
• %Program Files%\2345Soft\2345Explorer\Doctor\Doctor_2345Explorer.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SysDoctor.exe
• %Start Menu%\Programs\2345\xe5\xae\x89\xe5\x85\xa8\xe4\xb8\xad\xe5\xbf\x83\xe5\x8d\xb8\xe8\xbd\xbd2345\xe5\xae\x89\xe5\x85\xa8\xe5\x8d\xab\xe5\xa3\xab.lnk
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAX01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeBaseMon64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345Setting.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterCrashReport.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\AvShellExt64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\FileShre.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeCenter\2345Extract.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AH01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAE01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BE01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BL01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Install.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345SafeCenterSvc.data
• %Application Data%\2345SafeCenter\Data\InstClick.time
• %Program Files%\2345Soft\2345Explorer\resources.pak
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\Uninstall.exe
• %Application Data%\2345SafeCenter\Data\InstClick
• %Program Files%\2345Soft\2345Explorer\prefs.dat
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAA01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345Iron.data
• %Program Files%\2345Soft\2345Explorer\Swiftshader\libGLESv2.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AB01.data
• %User Temp%\2345explorer_installer_statistics.lock
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\CB01.dat
• %Start Menu%\Programs\2345\xe5\xae\x89\xe5\x85\xa8\xe4\xb8\xad\xe5\xbf\x83\2345\xe5\xae\x89\xe5\x85\xa8\xe5\x8d\xab\xe5\xa3\xab.lnk
• %Application Data%\SoftMgr_2345\2345SoftMgr.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdHipsLogic.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\icon\SoftUpdateRemind.ico
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AM01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftInstallHelper.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345ExProtect.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftInstaller.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LeakFixUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\LicXPlugin.dll
• %Program Files%\2345Soft\2345Explorer\10.8.1.20361.manifest
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\ProtectApi.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAF01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdInstallNotify.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BS01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftMgrShell.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SettingUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345NetMgr.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdConfigCenter.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AS01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAO01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\WebProtect.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345Misc.data
• %Program Files%\2345Soft\2345Explorer\v8_context_snapshot.bin
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AO01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftBox.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\TkNitrome.dll
• %Program Files%\2345Soft\2345Explorer\Trident_core.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SectionsBackup\SafeUpdate\UpdateSection.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AX01.data
• %Program Files%\2345Soft\2345Explorer\Assistant\2345InstDLL.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\libcurl_x86.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345MPCSafe.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBF01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\msvcr120.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Trash.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdMsgProtect.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\icon
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgr.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345Extract.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\2345SoftUninst2.dat
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345LSPFix.exe
• %User Temp%\MYi1nI.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\FileAssociate.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBC01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ProtectCenter.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeExpMon.dll
• %Program Files%\2345Soft\2345Explorer\Plugins\np-mswmp.dll
• %User Temp%\2345explorer_installer_statistics
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SFWebShell.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\AvScan.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdProcChainMon.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAntiVCloud.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeWebMon.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\UsbGuardUI.dll
• %Application Data%\SoftMgr_2345\Application\Common\icon\softupdateremind.ico
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BN01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdProtectManagerUI.dll
• %Application Data%\2345PCSafe\Update\download\0\2345PCSafe.NewVersion.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345Uninst.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Helper_2345SafeCenter.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdSvcMon.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\TkNitrome64.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\icon\SoftUninstall.ico
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\ProtectApi64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SpeedupUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAY01.data
• %Program Files%\2345Soft\2345Explorer\chrome.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345Speedup.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdHipsUpdate.dll
• %Application Data%\2345SafeCenter\Data\SafeCenterInstallRealTimeStat
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAS01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345CrashReport.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAntiVBusCore.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdEsswSndPlugin.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\NsProtectApi.dll
• %Program Files%\2345Soft\2345Explorer\2345Recommender.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAV01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AA01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAR01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SoftMgr\2345softmgr_v5.3.0.11631.7z
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AY01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAntiVEngine.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\UsbGuard.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdReflectDefender.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\DriverApi.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdRTPMsgController.dll
• %Program Files%\2345Soft\2345Explorer\Locales\zh-CN.pak
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\msvcr120.dll
• %Program Files%\2345Soft\2345Explorer\Assistant\OptimizeTool.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAviraSndPlugin.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\crash_service.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeBho.dll
• %Desktop%\2345\xe5\xae\x89\xe5\x85\xa8\xe5\x8d\xab\xe5\xa3\xab.lnk
• %Application Data%\SoftMgr_2345\Application\Common\icon\softuninstall.ico
• %Program Files%\2345Soft\2345Explorer\natives_blob.bin
• %Program Files%\2345Soft\2345Explorer\welcome.ini
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SoftMgr\2345SoftMgr.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BQ01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterDiff.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AI01.data
• %Program Files%\2345Soft\2345Explorer\Upgrade_2345Explorer.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeCenter\2345SafeCenter_v5.12.3.8233.7z
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAZ01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BP01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AD01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ExtShell64.exe
• %Program Files%\2345Soft\2345Explorer\snapshot_blob.bin
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdSvcMon64.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdRTProtectUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345TrashRcmd.exe
• %Program Files%\2345Soft\2345Explorer\libcurl_x86.dll
• %Application Data%\2345SoftMgr\stat\softmgrinstallstat
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAG01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345UsbGuard.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAC01.data
• %Program Files%\2345Soft\2345Explorer\widevinecdmadapter.dll
• %User Temp%\chrome_upgrade\operation_log.txt
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAJ01.data
• %Application Data%\2345SafeCenter\Data\ClickStat
• %Application Data%\2345SafeCenter\Data\SafeCenterInstallRealTimeStat.lock
• %Program Files%\2345Soft\2345Explorer\Extensions\defalut_extensions.json
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftRI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAF01.data
• %Program Files%\2345Soft\2345Explorer\chrome_200_percent.pak
• %Application Data%\2345PCSafe\Update\2345PCSafe.CheckVersion.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Extract.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAQ01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterMiniPage.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAH01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdRTPLog.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SFGuard.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\breakpad.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdHipsDefProtect.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAH01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeBho64.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Uninstall.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AL01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeCenterUpdate.dll
• %Program Files%\2345Soft\2345Explorer\Assistant\Update_2345Explorer.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeTray.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\rcrs.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdAntiVCache.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AK01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BY01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdGDOperate.dll
• %Program Files%\2345Soft\2345Explorer\Uninstall.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\icon\DefaultSoft.ico
• %Program Files%\2345Soft\2345Explorer\Assistant\2345InstUI.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\2345SoftClass.dat
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AU01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\msvcp120.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\Install2.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Associate.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftMgrShell64.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBH01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBD01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AT01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LuaBizBasic.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BU01.data
• %Program Files%\2345Soft\2345Explorer\chrome_child.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAG01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\crash_service.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdIronSlot.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345Iron.data
• %Program Files%\2345Soft\2345Explorer\Assistant\HelperTool64.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345MiniUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdVirusCloud.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Install.data
• %Application Data%\2345PCSafe\Config\Optimize
• %Program Files%\2345Soft\2345SafeCenter\CommonFiles\Config\PopupsMutex
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BBG01.data
• %System Root%\Global??\FltMgrMsg
• %Application Data%\2345PCSafe\Config\LeakDownloaded
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAD01.data
• %Program Files%\2345Soft\2345Explorer\capture.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\TrashRcmdUI.dll
• %Program Files%\2345Soft\2345Explorer\chrome_watcher.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdDefenceLogic.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SafeTrayUI.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345MiniUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AG01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345Base.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SafeWebMon64.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAM01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\SoftMgrUI.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\Install1.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\SysDoctor.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SafeCenter\2345SafeCenterInstaller.exe
• %Program Files%\2345Soft\2345Explorer\chrome_initial.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SafeDispatcher.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BG01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ManuUpdate.exe
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345SoftInstallAgent.exe
• %Application Data%\SoftMgr_2345\Application\config.ini
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\2345Font
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\86_2345ExProtect.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BA01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345FileShre.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\courgette_dll.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345SoftMgr\2345Extract.dll
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\msvcp120.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AZ01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AP01.data
• %Application Data%\2345PCSafe\Config\ShortcutArrow
• %Program Files%\2345Soft\2345Explorer\icudtl.dat
• %Program Files%\2345Soft\2345Explorer\libglesv2.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterUpdate.exe
• %Application Data%\2345PCSafe\Config\SettingConf
• %Program Files%\2345Soft\2345Explorer\Upgrade_2345Explorer.dll
• %Program Files%\2345Soft\2345Explorer\chrome_100_percent.pak
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\AvShellExt.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\NetFlow.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAP01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAU01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\2345LeakFixer.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LeakFixEngine.dll
• %Program Files%\2345Soft\2345Explorer\Doctor\Downloader_2345Explorer.exe
• %Application Data%\SoftMgr_2345\Uninstall.exe
• %Windows%\Temp\{BB10E2FF-D0C2-4DB5-950A-EF275A482E9D}
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\LSPFix.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\libcurl_x86.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\libcurl_x86.dll
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\breakpad.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345RTProtect.exe
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\SdSMgr.dll
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345Prot.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\courgette_dll.dll
• %Application Data%\2345AvScan\2345MonCfg
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\Recover\64_2345NetMgr.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\coral_extract.dll
• %Program Files%\2345Soft\2345Explorer\crashpad_helper.exe
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AAA01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BAL01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BD01.data
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345SFGuard64.exe
• %Application Data%\2345PCSafe\Config\SafeTray
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BM01.data
• %Program Files%\2345Soft\2345Explorer\install.log
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\Data\BK01.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\rcrs.data
• %Program Files%\2345Soft\2345PCSafe\5.6.0.12087\Data\AE01.data
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft
• %Application Data%\SoftMgr_2345\Application\5.3.0.11631\2345Soft\data\2345SoftOption.dat
• %Program Files%\2345Soft\2345SafeCenter\5.12.3.8233\2345ProtectManager.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}r.gov.hk/cgi-bin/hko/ntime.pl
• http://0.{BLOCKED}t.com/0md5.txt
• http://0.{BLOCKED}t.com/0.txt
• http://jjk.{BLOCKED}t.com/uqcjjj
• http://dngj.{BLOCKED}t.com/1.vbs
• http://download.{BLOCKED}5.cn/{random path}
• http://download.{BLOCKED}5.cn/silence/{BLOCKED}5Explorer_209411_silence.exe
• http://t.{BLOCKED}an.2345.com/proc/ie/index.php
• http://t.{BLOCKED}e.2345.com/{BLOCKED}e_realtime/index.php
• http://t.{BLOCKED}e.2345.com/{BLOCKED}e_installinfo/index.php
• http://update.{BLOCKED}e.2345.com/wangpai/check_info.php
• http://t.{BLOCKED}an.2345.com/stat/safe/index.php
• http://update.{BLOCKED}an.2345.com/check_new_version_next.php
• http://update.{BLOCKED}e.2345.com/check_new_version.php
• http://update.{BLOCKED}d.2345.cc/safe/check_mod_data.php
• http://db.{BLOCKED}e.2345.com

This report is generated via an automated analysis system.