Trojan.Siggen32.27273

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Clients\StartMenuInternet\2345Explorer.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Explorer\2345Explorer.exe"'
[HKCU\Software\Classes\Applications\2345Explorer.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Explorer\2345Explorer.exe" "%1"'
[HKCU\Software\Classes\2345ExplorerHTML\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Explorer\2345Explorer.exe" "%1"'
[HKLM\Software\Classes\http\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Explorer\2345Explorer.exe" "%1"'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Patches code

in dll

2345explorer.exe process, combase.dll module
2345explorer.exe process, RPCRT4.dll module
2345explorer.exe process, KERNELBASE.dll module
2345explorer.exe process, SHELL32.dll module
2345explorer.exe process, WS2_32.dll module
2345explorer.exe process, urlmon.dll module
2345explorer.exe process, WININET.dll module
2345explorer.exe process, VERSION.dll module
2345explorer.exe process, iertutil.dll module
2345explorer.exe process, USER32.dll module

Modifies file system

Creates the following files

%TEMP%\nsa2f79.tmp
%TEMP%\nsp2f89.tmp\system.dll
%TEMP%\nsp2f89.tmp\modern-header.bmp
%TEMP%\nsp2f89.tmp\fileinfo.dll
%TEMP%\nsp2f89.tmp\rcpicplugin.dll
%APPDATA%\2345explorer\coralinst.sts
%ProgramFiles(x86)%\2345explorer\2345explorer.exe
%ProgramFiles(x86)%\2345explorer\coralapp.dll
%ProgramFiles(x86)%\2345explorer\coral.dll
%ProgramFiles(x86)%\2345explorer\coraldb.dll
%ProgramFiles(x86)%\2345explorer\coraldownload.dll
%ProgramFiles(x86)%\2345explorer\coraltrident.dll
%ProgramFiles(x86)%\2345explorer\coralui.dll
%ProgramFiles(x86)%\2345explorer\coralupdate.dll
%ProgramFiles(x86)%\2345explorer\coralrender.dll
%ProgramFiles(x86)%\2345explorer\coralextract.dll
%ProgramFiles(x86)%\2345explorer\coralhtmlwnd.dll
%ProgramFiles(x86)%\2345explorer\2345explorerreg.exe
%ProgramFiles(x86)%\2345explorer\addon\capture.addon
%ProgramFiles(x86)%\2345explorer\lang\corallang_chs.dll
%ProgramFiles(x86)%\2345explorer\2345王牌浏览器免责声明.txt
%ProgramFiles(x86)%\2345explorer\msvcr80.dll
%ProgramFiles(x86)%\2345explorer\microsoft.vc80.crt.manifest
%ProgramFiles(x86)%\2345explorer\coralui2.dll
%ProgramFiles(x86)%\2345explorer\skins\coral.dui
%ProgramFiles(x86)%\2345explorer\skins\coral.skn
%ProgramFiles(x86)%\2345explorer\skins\coralie.skn
%ProgramFiles(x86)%\2345explorer\skins\growth.skn
%ProgramFiles(x86)%\2345explorer\skins\pink.skn
%ProgramFiles(x86)%\2345explorer\skins\coral.xml
%ProgramFiles(x86)%\2345explorer\usercenter\regretry.htm
%ProgramFiles(x86)%\2345explorer\usercenter\retry.htm
%ProgramFiles(x86)%\2345explorer\usercenter\css\p_login.css
%ProgramFiles(x86)%\2345explorer\usercenter\css\sign.css
%ProgramFiles(x86)%\2345explorer\usercenter\images\lg_retry.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\lg_sprite.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\retry_banner.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\retry_banner2.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\sign_btnbg.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\sign_btnbg_h.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\sign_delbtn.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\sign_dropbtn.png
%ProgramFiles(x86)%\2345explorer\usercenter\images\yzm.png
%ProgramFiles(x86)%\2345explorer\startpage\blank.htm
%ProgramFiles(x86)%\2345explorer\startpage\coral404.htm
%ProgramFiles(x86)%\2345explorer\startpage\incognito.htm
%ProgramFiles(x86)%\2345explorer\startpage\index.htm
%ProgramFiles(x86)%\2345explorer\startpage\malice.htm
%ProgramFiles(x86)%\2345explorer\startpage\pop_edit.html
%ProgramFiles(x86)%\2345explorer\startpage\recovery.htm
%ProgramFiles(x86)%\2345explorer\startpage\search.htm
%ProgramFiles(x86)%\2345explorer\startpage\css\home.css
%ProgramFiles(x86)%\2345explorer\startpage\css\incognito.css
%ProgramFiles(x86)%\2345explorer\startpage\css\jquery.loadmask.css
%ProgramFiles(x86)%\2345explorer\startpage\css\search.css
%ProgramFiles(x86)%\2345explorer\startpage\fancybox\jquery.fancybox-1.3.4.css
%ProgramFiles(x86)%\2345explorer\startpage\fancybox\jquery.fancybox-1.3.4.js
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_01.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_01_1366.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_02.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_02_1366.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_03.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_03_1366.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_04.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_04_1366.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_default.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_pre_01.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_pre_02.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_pre_03.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_pre_04.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\wallpaper_pre_default.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\add.png
%ProgramFiles(x86)%\2345explorer\startpage\images\add_bg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\add_hover.png
%ProgramFiles(x86)%\2345explorer\startpage\images\all_search_icon_baidu.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\bdbg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\bg_404.png
%ProgramFiles(x86)%\2345explorer\startpage\images\blank.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\btn_sprite.png
%ProgramFiles(x86)%\2345explorer\startpage\images\close_tab.png
%ProgramFiles(x86)%\2345explorer\startpage\images\close_tab2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\dd_dot.png
%ProgramFiles(x86)%\2345explorer\startpage\images\detail_bg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\detail_btn.png
%ProgramFiles(x86)%\2345explorer\startpage\images\gradient_bg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\gradient_bottom.png
%ProgramFiles(x86)%\2345explorer\startpage\images\gradient_top.png
%ProgramFiles(x86)%\2345explorer\startpage\images\grid_load.png
%ProgramFiles(x86)%\2345explorer\startpage\images\guide_ie.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\hot.png
%ProgramFiles(x86)%\2345explorer\startpage\images\ico_360.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\ico_ie.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\ico_sogo.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\ico_tt.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\iconbg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\iconmap.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_game.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_goods.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_inquiry.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_movie.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_music.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_news.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_novel.png
%ProgramFiles(x86)%\2345explorer\startpage\images\icon_weather.png
%ProgramFiles(x86)%\2345explorer\startpage\images\list_bg.png
%ProgramFiles(x86)%\2345explorer\startpage\images\loading.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_bottombar_report.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_bottombar_report2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_bottombar_report3.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_content_error.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_bj.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_blank.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_blank_hover.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_edit.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_edit_hover.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_remove.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_remove2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_bar_remove_hover.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item22.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item2_hover1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item_add.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item_hover1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_grid_item_loading.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bg1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bg2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bg_search.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bigicon_baidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bigicon_google.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bigicon_sogou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_bigicon_soso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_button_bg1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_button_bg2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_button_bg3.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_xl_arrow.png
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_xl_background1.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\main_search_xl_background2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\page_white.png
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_background.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_background.png
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_close.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_close2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_edit_background.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_edit_background2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_edit_bg.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_edit_bg1.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_edit_bg2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_button.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_button2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_button3.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon1.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon3.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon4.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_icon4_2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_tit.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_tit2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_tit_hover.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_list_tit_hover2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_preview_but.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\popup_dialog_preview_but2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\preview_plus.bmp
%ProgramFiles(x86)%\2345explorer\startpage\images\quan.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\search_baidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search_google.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search_sogou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\sprite_0718.png
%ProgramFiles(x86)%\2345explorer\startpage\images\switch_bj.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\switch_combar_icon1.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\switch_widbar_icon2.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_163.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_2345.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_baidu.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_fenghuang.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_google.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_qq.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_sina.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_sogo.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_sohu.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\wico_soso.gif
%ProgramFiles(x86)%\2345explorer\startpage\images\error\404_1.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\error\404_2.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\error\btn.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\2345_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\ai_taobao_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\baidu_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\book_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\dongman_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\fenghuang_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\game.2345.com.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\game2_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\game_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\qq_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\sina_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\sohu_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\taobao_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\tv_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\home\weibo_big.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\bgrx.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main.jpg
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bg1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bg2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bigicon_baidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bigicon_google.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bigicon_sogou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_bigicon_soso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_button_bg1.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_button_bg2.png
%ProgramFiles(x86)%\2345explorer\startpage\images\incognito\main_search_button_bg3.png
%ProgramFiles(x86)%\2345explorer\startpage\images\informantcenter\closea.png
%ProgramFiles(x86)%\2345explorer\startpage\images\informantcenter\popa.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_baidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_bing.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_dbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_dgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_gdangdang.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_gjingdong.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_gjyjo.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_google.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_gpaipai.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_gtaobao.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_ibaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_igoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_isoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_mbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_mgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_msoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_none.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_sogou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_soso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_vbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_vgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_vsoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_vtudou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_vyouku.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_wbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_wsoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_wwiki.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_xduote.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_xshooter.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_xverycd.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_xxunlei.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_yahoo.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_icon_youdao.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_baidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_bing.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_dbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_dgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_gdangdang.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_gjingdong.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_gjyjo.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_google.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_gpaipai.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_gtaobao.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_ibaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_igoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_isoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_mbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_mgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_msoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_none.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_sogou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_soso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_vbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_vgoogle.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_vsoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_vtudou.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_vyouku.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_wbaidu.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_wsoso.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_wwiki.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_xduote.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_xshooter.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_xverycd.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_xxunlei.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_yahoo.png
%ProgramFiles(x86)%\2345explorer\startpage\images\search\main_search_logo_youdao.png
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_clickcount.js
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_commom.js
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_lib_min.js
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_myfav.js
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_se.js
%ProgramFiles(x86)%\2345explorer\startpage\js\coral_search.js
%ProgramFiles(x86)%\2345explorer\startpage\js\index.js
%ProgramFiles(x86)%\2345explorer\startpage\js\jquery.loadmask.js
%ProgramFiles(x86)%\2345explorer\startpage\js\move.js
%ProgramFiles(x86)%\2345explorer\startpage\js\png.js
%ProgramFiles(x86)%\2345explorer\startpage\js\zoom.js
%ProgramFiles(x86)%\2345explorer\startpage\pie\pie.htc
%ProgramFiles(x86)%\2345explorer\config\favicon\1860f34853bbc50f66bf81b679989830.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\3d6a8ac8f2013b0d7a1ea53076e96320.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\6e086a7049dd129df69051413ac6ab3a.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\81c6af03ac3e2b181dd99a3c1afd1aa3.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\85131c29c8f7b398a345bd7f1a51dab1.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\8fdead446a8d607c20207d38d669e349.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\da3e6e24050aa14e8fd334f6da0ae9f1.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\f2a7bed2a1035f9e4ec022b3eca481a8.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\default_page.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\home.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\private.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\recovery.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\taskmanager.ico
%ProgramFiles(x86)%\2345explorer\config\favicon\1860f34853bbc50f66bf81b679989830.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\3d6a8ac8f2013b0d7a1ea53076e96320.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\6e086a7049dd129df69051413ac6ab3a.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\81c6af03ac3e2b181dd99a3c1afd1aa3.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\85131c29c8f7b398a345bd7f1a51dab1.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\8fdead446a8d607c20207d38d669e349.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\da3e6e24050aa14e8fd334f6da0ae9f1.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\favicon\f2a7bed2a1035f9e4ec022b3eca481a8.ico.jpg
%ProgramFiles(x86)%\2345explorer\config\users\default\systemurl.data
%ProgramFiles(x86)%\2345explorer\config\users\default\head_default.png
%ProgramFiles(x86)%\2345explorer\config\users\default\login_head_default.png
%APPDATA%\2345explorer\favicon\1860f34853bbc50f66bf81b679989830.ico
%APPDATA%\2345explorer\favicon\3d6a8ac8f2013b0d7a1ea53076e96320.ico
%APPDATA%\2345explorer\favicon\6e086a7049dd129df69051413ac6ab3a.ico
%APPDATA%\2345explorer\favicon\81c6af03ac3e2b181dd99a3c1afd1aa3.ico
%APPDATA%\2345explorer\favicon\85131c29c8f7b398a345bd7f1a51dab1.ico
%APPDATA%\2345explorer\favicon\8fdead446a8d607c20207d38d669e349.ico
%APPDATA%\2345explorer\favicon\da3e6e24050aa14e8fd334f6da0ae9f1.ico
%APPDATA%\2345explorer\favicon\f2a7bed2a1035f9e4ec022b3eca481a8.ico
%APPDATA%\2345explorer\favicon\default_page.ico
%APPDATA%\2345explorer\favicon\home.ico
%APPDATA%\2345explorer\favicon\private.ico
%APPDATA%\2345explorer\favicon\recovery.ico
%APPDATA%\2345explorer\favicon\taskmanager.ico
%APPDATA%\2345explorer\favicon\1860f34853bbc50f66bf81b679989830.ico.jpg
%APPDATA%\2345explorer\favicon\3d6a8ac8f2013b0d7a1ea53076e96320.ico.jpg
%APPDATA%\2345explorer\favicon\6e086a7049dd129df69051413ac6ab3a.ico.jpg
%APPDATA%\2345explorer\favicon\81c6af03ac3e2b181dd99a3c1afd1aa3.ico.jpg
%APPDATA%\2345explorer\favicon\85131c29c8f7b398a345bd7f1a51dab1.ico.jpg
%APPDATA%\2345explorer\favicon\8fdead446a8d607c20207d38d669e349.ico.jpg
%APPDATA%\2345explorer\favicon\da3e6e24050aa14e8fd334f6da0ae9f1.ico.jpg
%APPDATA%\2345explorer\favicon\f2a7bed2a1035f9e4ec022b3eca481a8.ico.jpg
%APPDATA%\2345explorer\users\default\systemurl.data
%ProgramFiles(x86)%\2345explorer\uninstall.exe
%APPDATA%\2345explorer\users\default\crashurl.data-journal
%APPDATA%\2345explorer\users\default\crashurl.data
%APPDATA%\2345explorer\users\default\startpageconfig.data-journal
%APPDATA%\2345explorer\users\default\startpageconfig.data
%APPDATA%\2345explorer\users\default\smarturl.data-journal
%APPDATA%\2345explorer\users\default\smarturl.data
%APPDATA%\2345explorer\users\default\history.data-journal
%APPDATA%\2345explorer\users\default\history.data
%APPDATA%\2345explorer\users\default\download.data-journal
%APPDATA%\2345explorer\users\default\download.data
%APPDATA%\2345explorer\users\default\setting.cfg
%APPDATA%\2345explorer\users\default\formdata.data
%APPDATA%\2345explorer\users\default\onlinefav.data
%TEMP%\2345explorer\rt~410c.tmp
%APPDATA%\2345explorer\users\default\favoritesupdate.data
%TEMP%\2345explorer\rt~412c.tmp
%APPDATA%\2345explorer\temp.png
%TEMP%\2345explorer\rt~4275.tmp
%APPDATA%\2345explorer\2345explorer.hzv
%APPDATA%\microsoft\windows\start menu\2345王牌浏览器.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\2345王牌浏览器.lnk
%APPDATA%\microsoft\windows\start menu\programs\2345王牌浏览器\2345王牌浏览器.lnk
%APPDATA%\microsoft\windows\start menu\programs\2345王牌浏览器\卸载2345王牌浏览器.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌浏览器\2345王牌浏览器.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌浏览器\卸载2345王牌浏览器.lnk
%HOMEPATH%\desktop\2345王牌浏览器.lnk
%APPDATA%\microsoft\internet explorer\quick launch\2345王牌浏览器.lnk
%TEMP%\2345explorer\rt~4b31.tmp
%TEMP%\2345explorer\rt~5271.tmp
%TEMP%\2345explorer\rt~5407.tmp
%APPDATA%\2345explorer\users\default\statistics.tmp
%TEMP%\2345explorer\rt~554f.tmp
%TEMP%\2345explorer\rt~55cd.tmp
%TEMP%\2345explorer\rt~561b.tmp
%TEMP%\2345explorer\rt~562c.tmp
%APPDATA%\2345explorer\users\default\arulist.data
%TEMP%\2345explorer\rt~59c7.tmp
%APPDATA%\2345explorer\users\default\statistics.data
%TEMP%\2345explorer\rt~5c97.tmp
%TEMP%\2345explorer\rt~5d3f.tmp
%APPDATA%\2345explorer\coral.sts
%TEMP%\2345explorer\rt~640a.tmp
%TEMP%\2345explorer\rt~689f.tmp
%TEMP%\2345explorer\rt~6b02.tmp
%TEMP%\2345explorer\rt~6b34.tmp
%TEMP%\2345explorer\rt~6c42.tmp
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%TEMP%\2345explorer\rt~7de7.tmp
%TEMP%\2345explorer\rt~7df8.tmp
%TEMP%\2345explorer\rt~7df9.tmp
%TEMP%\2345explorer\rt~7eb5.tmp
%APPDATA%\2345explorer\temp\pending.hzt
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\download.data.2026.03.01.02.20
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\formdata.data.2026.03.01.02.20
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\startpageconfig.data.2026.03.01.02.20
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\onlinefav.data.2026.03.01.02.20
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\favoritesupdate.data.2026.03.01.02.20
%APPDATA%\2345explorer\users\backup\dailybackup_2026.03.01\setting.cfg.2026.03.01.02.20

Deletes following files that it created itself

%ProgramFiles(x86)%\2345explorer\2345explorer.exe
%APPDATA%\2345explorer\users\default\crashurl.data-journal
%APPDATA%\2345explorer\users\default\startpageconfig.data-journal
%APPDATA%\2345explorer\users\default\smarturl.data-journal
%APPDATA%\2345explorer\users\default\history.data-journal
%APPDATA%\2345explorer\users\default\download.data-journal
%APPDATA%\2345explorer\users\default\statistics.tmp
%TEMP%\2345explorer\rt~6b02.tmp
%APPDATA%\2345explorer\coralinst.sts
%TEMP%\nsp2f89.tmp\fileinfo.dll
%TEMP%\nsp2f89.tmp\modern-header.bmp
%TEMP%\nsp2f89.tmp\rcpicplugin.dll
%TEMP%\nsp2f89.tmp\system.dll

Moves the following files

from %TEMP%\2345explorer\rt~410c.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~412c.tmp to %APPDATA%\2345explorer\users\default\favoritesupdate.data
from %TEMP%\2345explorer\rt~4275.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~4b31.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~5271.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~5407.tmp to %APPDATA%\2345explorer\users\default\formdata.data
from %TEMP%\2345explorer\rt~554f.tmp to %APPDATA%\2345explorer\users\default\statistics.tmp
from %TEMP%\2345explorer\rt~55cd.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~561b.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~562c.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~59c7.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~5c97.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~5d3f.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~640a.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~689f.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~6b34.tmp to %APPDATA%\2345explorer\users\default\favoritesupdate.data
from %TEMP%\2345explorer\rt~6c42.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~7de7.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~7df8.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~7df9.tmp to %APPDATA%\2345explorer\users\default\setting.cfg
from %TEMP%\2345explorer\rt~7eb5.tmp to %APPDATA%\2345explorer\users\default\setting.cfg

Substitutes the following files

%ProgramFiles(x86)%\2345explorer\2345explorer.exe
%APPDATA%\2345explorer\users\default\crashurl.data-journal
%APPDATA%\2345explorer\users\default\smarturl.data-journal
%APPDATA%\2345explorer\users\default\history.data-journal
%APPDATA%\2345explorer\users\default\download.data-journal
%APPDATA%\2345explorer\users\default\statistics.tmp
%APPDATA%\2345explorer\users\default\startpageconfig.data-journal

Network activity

UDP

DNS ASK ie.#345.com
DNS ASK up####.ie.2345.com
DNS ASK 23##.com
DNS ASK ua.##.2345.com

Miscellaneous

Searches for the following windows

ClassName: '{69CAC4F0-46B3-46B3-8559-AD2C340A26D5}' WindowName: ''
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Executes the following

'%ProgramFiles(x86)%\2345explorer\2345explorer.exe' ' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial