FÜR NUTZER

Schließen

Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Suche
Suche

Support
Support 24/7 | Regeln zur Anfragenübermittlung

Schreiben Sie uns

Online-Formular

Telefon

+49 (0) 170 488 40 28

Forum

Ihre Anfragen

Neue Anfrage

Rufen Sie uns an

+7 (495) 789-45-86

Profil

DE

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Schließen
Services
Scanner
Dr.Web vxCube
Testversion
Analyse von virenabhängigen Vorfällen
Virenbibliothek
Wissensdatenbank

Technologies

Begriffe

Schulung und Training

Mythen

News

Trojan.Siggen19.64031

Added to the Dr.Web virus database: 2023-03-07

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\SOFTWARE\Classes\2345Pic.bmp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.kdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.mdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.mdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.mef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.mef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.mos\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.mos\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.mrw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.kc2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.kdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.mrw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.nrw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.nrw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.orf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.orf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ptx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ptx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.nef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.nef\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.kc2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.k25\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pxn\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.crw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cs1\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cs1\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dc2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dc2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dcr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dcr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.drf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.drf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dsc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dsc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.fff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.fff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ia\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ia\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.iiq\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.iiq\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pxn\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cr3\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.k25\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.j2c\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.qtk\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pnm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pgm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pgm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ppm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ppm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ska\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ska\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.webp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.webp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.wdp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.wdp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.tbi\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.tbi\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.heic\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.heic\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ai\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ai\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ofd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ofd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pnm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cr3\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.crw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jpc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.raf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.raf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.rdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.rdc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.rw2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.rw2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.rwz\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.rwz\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.sr2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.sr2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.srf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.srf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.sti\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.sti\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.x3f\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.x3f\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.wmf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.wmf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.emf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.emf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jpc\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pgx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.qtk\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cr2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cr2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cine\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pcx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pcx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.png\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.png\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ras\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ras\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.tga\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.tga\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.targa\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.targa\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.tif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.tif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.tiff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.tiff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.wap\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.wap\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.wbmp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.wbmp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.wbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.mng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.lbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pcd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pdf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.wbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.lbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dib\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dib\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.ico\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.ico\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cur\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cur\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jpg\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jpg\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jpeg\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.bmp\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jpeg\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jpe\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jfif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jfif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.koa\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.koa\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.iff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.iff\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jpe\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.mng\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pgx\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.psd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.psb\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pfm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pct\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pct\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pict\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pict\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pic\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pic\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.raw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.raw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.3fr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.3fr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.arw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.arw\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.bay\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.bay\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.bmq\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.bmq\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cap\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cap\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cine\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.psd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pfm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.psb\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.jp2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.pcd\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.cut\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.cut\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.xbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.xbm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.xpm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.xpm\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.dds\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.dds\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.gif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.gif\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.hdr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.hdr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.g3\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.g3\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.sgi\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.sgi\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.exr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.exr\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.j2k\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.j2k\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.j2c\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKLM>\SOFTWARE\Classes\2345Pic.jp2\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PicViewer.exe" "%1"'
  • [<HKCU>\Software\Classes\2345Pic.pdf\shell\open\command] '' = '"%ProgramFiles(x86)%\2345Soft\2345Pic\2345PdfReader.exe" "%1"'
Creates or modifies the following files
  • <SYSTEM32>\tasks\pic_2345upgrade task
Sets the following service settings
  • [<HKLM>\System\CurrentControlSet\Services\ViewPic_2345Svc] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\ViewPic_2345Svc] 'ImagePath' = '%ProgramFiles(x86)%\2345Soft\2345Pic\protect\Pic_2345Svc.exe'
Creates the following services
  • 'ViewPic_2345Svc' %ProgramFiles(x86)%\2345Soft\2345Pic\protect\Pic_2345Svc.exe
Modifies file system
Creates the following files
  • %TEMP%\nsc897b.tmp
  • %APPDATA%\2345pic\application\10.9.1.9791\freeimageplus.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\freeimage.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345pdfapp.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345imagecapture.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345batchrename.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345miniui.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345feedbackapp.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\libcurl_x86.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\coral_extract.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\courgette.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\pdfium.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\zlib.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\icuuc.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345picupdate.exe
  • %APPDATA%\2345pic\application\10.9.1.9791\2345picloader.exe
  • %APPDATA%\2345pic\application\10.9.1.9791\2345picdumper.exe
  • %APPDATA%\2345pic\application\10.9.1.9791\2345pictool.exe
  • %APPDATA%\2345pic\application\10.9.1.9791\2345pichelper.exe
  • %APPDATA%\2345pic\application\10.9.1.9791\lang\2345editorlang_chs.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345image.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\lang\2345imagelang_chs.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345printerapp.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345imageapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\lang\2345imagelang_chs.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\lang\2345editorlang_chs.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\hdpi\2345pdf_x100.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\hdpi\2345pdf_x125.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\hdpi\2345pdf_x200.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\hdpi\2345imageres_x125.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\hdpi\2345imageres_x150.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\bmp.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\common.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\gif.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\jpg.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\png.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\tif.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\psd.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\pdf.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\icon\ofd.ico
  • %ProgramFiles(x86)%\2345soft\2345pic\uninstall.exe
  • %TEMP%\nsr898b.tmp\system.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345imagethumb64.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\2345editorapp.dll
  • %APPDATA%\2345pic\rescue.dat
  • %APPDATA%\2345pic\rcimage.stat
  • %APPDATA%\2345pic\application\10.9.1.9791\hdpi\2345pdf_x100.dll
  • %APPDATA%\2345pic\rcoptimizeupdate.hzc
  • %APPDATA%\2345pic\2345image.hzv
  • %ProgramFiles(x86)%\2345soft\2345pic\tool\2345instdll.dll
  • %APPDATA%\2345pic\rcimage.stat.lock
  • %TEMP%\ri~c50.tmp.tmp
  • %TEMP%\ri~115e.tmp.tmp
  • %APPDATA%\2345pic\update\download\pdfconvertergreenloader.tmp
  • %APPDATA%\2345pic\pdfeditor\launcher\launcher.exe
  • %APPDATA%\2345pic\update\download\ocrconvertergreenloader.tmp
  • %APPDATA%\2345pic\pdfeditor\cloudconfig.dat
  • %APPDATA%\2345pic\update\download\ocrgreenloader\2345pdfgreenloader.dll
  • %APPDATA%\2345pic\update\download\ocrgreenloader\coral_extract.dll
  • %APPDATA%\2345pic\update\2345pic.checkstat.data
  • %APPDATA%\2345pic\rcimageinstall.stat.lock
  • %APPDATA%\2345ocr\update\download\ocrconvertergreen.tmp
  • %APPDATA%\2345pic\rcimageinstall.stat.time
  • %APPDATA%\2345pic\update\download\pdfgreenloader\2345pdfgreenloader.dll
  • %APPDATA%\2345pic\update\download\pdfgreenloader\coral_extract.dll
  • %APPDATA%\2345pdfconverter\update\download\pdfconvertergreen.tmp
  • %APPDATA%\2345pic\rcimage.rt.ust.time
  • %ProgramFiles(x86)%\2345soft\2345pic\tool\2345instui.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\config.ini
  • %APPDATA%\2345pic\cloudconfig.dat
  • %APPDATA%\2345pic\application\10.9.1.9791\hdpi\2345pdf_x125.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\hdpi\2345pdf_x200.dll
  • %APPDATA%\2345pic\config.ini
  • %ProgramFiles(x86)%\2345soft\2345pic\install.data
  • %APPDATA%\2345pic\rcimage.rt.ust
  • %APPDATA%\2345pic\rcimage.hzc
  • %APPDATA%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-图片管理.lnk
  • %APPDATA%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王.lnk
  • %APPDATA%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-图片美化.lnk
  • %APPDATA%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-pdf阅读器.lnk
  • %APPDATA%\microsoft\windows\start menu\programs\2345王牌软件\看图王\卸载看图王.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-图片管理.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-图片美化.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌软件\看图王\看图王-pdf阅读器.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\2345王牌软件\看图王\卸载看图王.lnk
  • %APPDATA%\microsoft\internet explorer\quick launch\看图王-图片管理.lnk
  • %HOMEPATH%\desktop\2345看图王.lnk
  • %APPDATA%\2345pic\rcimage.rt.ust.lock
  • %APPDATA%\2345pic\application\10.9.1.9791\hdpi\2345imageres_x125.dll
  • %APPDATA%\2345pic\application\10.9.1.9791\hdpi\2345imageres_x150.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\tool\2345picmgr64.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-handle-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345imagecapture.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345batchrename.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\msvcp140.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\vcruntime140.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\concrt140.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\coral_extract.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\courgette.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pichomepage.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345miniui.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345feedbackapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\libcurl_x86.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\pdfium.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\zlib.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\icuuc.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-console-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-datetime-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-debug-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-errorhandling-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-file-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pdfapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-file-l1-2-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\d3dx9_43.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\freeimageplus.dll
  • %TEMP%\nsr898b.tmp\fileinfo.dll
  • %TEMP%\nsr898b.tmp\libcurl_x86.dll
  • %TEMP%\nsr898b.tmp\rcwidgetplugin.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picviewer.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pic.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345piccapture.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345piceditor.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pdfreader.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picloader.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picupdate.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picdumper.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picprinter.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pictool.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345pichelper.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345picfeedback.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\2345imageapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345editorapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345printerapp.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\2345image.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\freeimage.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-heap-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\tool\update_2345pic.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-heap-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-multibyte-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-private-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-process-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-runtime-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-stdio-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-string-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-time-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-utility-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\ucrtbase.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\pic_2345upgrade.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\pic_2345upgrade.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\coral_extract.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\pic_2345svc.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\pic_2345svc.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\helper_2345pic.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\servicemanager.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\tool_uninstall.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\2345picassistant.exe
  • %ProgramFiles(x86)%\2345soft\2345pic\protect\courgette_dll.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-math-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\tool\2345picmgr.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-locale-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-filesystem-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-interlocked-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-libraryloader-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-localization-l1-2-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-memory-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-namedpipe-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-processenvironment-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-processthreads-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-processthreads-l1-1-1.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-profile-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-string-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-synch-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-synch-l1-2-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-sysinfo-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-timezone-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-util-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-conio-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-convert-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-crt-environment-l1-1-0.dll
  • %ProgramFiles(x86)%\2345soft\2345pic\api-ms-win-core-file-l2-1-0.dll
  • %TEMP%\ri~c414.tmp.tmp
Deletes the following files
  • %APPDATA%\2345pic\rcimage.rt.ust
  • %APPDATA%\2345pic\rcimage.rt.ust.lock
  • %APPDATA%\2345pic\rcimage.stat.lock
  • %TEMP%\nsr898b.tmp\fileinfo.dll
  • %TEMP%\nsr898b.tmp\libcurl_x86.dll
  • %TEMP%\nsr898b.tmp\rcwidgetplugin.dll
  • %TEMP%\nsr898b.tmp\system.dll
  • %TEMP%\ri~c50.tmp
  • %APPDATA%\2345pic\rcimageinstall.stat.lock
Moves the following files
  • from %TEMP%\ri~c50.tmp.tmp to %TEMP%\ri~c50.tmp
  • from %APPDATA%\2345pic\update\download\ocrconvertergreenloader.tmp to %APPDATA%\2345pic\update\download\ocrconvertergreenloader
  • from %APPDATA%\2345pic\update\download\pdfconvertergreenloader.tmp to %APPDATA%\2345pic\update\download\pdfconvertergreenloader
Substitutes the following files
  • %APPDATA%\2345pic\rcimage.stat.lock
  • %APPDATA%\2345pic\rcimage.rt.ust
Network activity
Connects to
  • 't-###.2345.com':80
  • 'up####-pic.2345.cc':443
  • 'im#####yin.2345cdn.net':80
  • 'up####-zl.2345.cc':443
  • 'zl###i.2345.cc':443
  • 't-####duan.2345.com':80
  • 'microsoft.com':80
  • 'oc##.##ust-provider.cn':80
TCP
HTTP GET requests
  • http://im#####yin.2345cdn.net/2345pdfeditor/62/62e09eeda5f5ec55c063d4afee13b648.7z
  • http://im#####yin.2345cdn.net/2345pic/c5/c58ee6d8e57b80f1f5c4f54600dda070.zip
  • http://im#####yin.2345cdn.net/2345pinyin/dc/dcd8990aa280248f948362a6c93e7abd.7z
  • http://im#####yin.2345cdn.net/2345pic/4d/4de731b734fe5310c598371353469e0b.7z
  • http://im#####yin.2345cdn.net/2345pdfcvt/ba/bad7ba2c9fb6d4d9d0dd5ceb44ecf81a.7z
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
  • http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQfY0iMel%2FQ3ObiccFYuQscrpnsSwQUyjEhNwzeObfSKy1VmlypqVxQ%2BiYCEGaAKcG0Qdsio24ed%2Fei7zw%3D
  • http://im#####yin.2345cdn.net/2345pdfeditor/a4/a41a716c35057a307f08d8ad84a53f75.7z
HTTP POST requests
  • http://t-###.2345.com/pic_realtime/index.php
  • http://t-####duan.2345.com/stat/pic/index.php
Other
  • 'up####-pic.2345.cc':443
  • 'zl###i.2345.cc':443
UDP
  • DNS ASK t-###.2345.com
  • DNS ASK up####-pic.2345.cc
  • DNS ASK im#####yin.2345cdn.net
  • DNS ASK up####-zl.2345.cc
  • DNS ASK zl###i.2345.cc
  • DNS ASK t-####duan.2345.com
  • DNS ASK microsoft.com
  • DNS ASK oc##.##ust-provider.cn
Miscellaneous
Creates and executes the following
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picloader.exe' --fixdir
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picloader.exe' -recorderRealtimeStat aq_01#0;aq_02#
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picloader.exe' -install 134
  • '%ProgramFiles(x86)%\2345soft\2345pic\protect\servicemanager.exe' install "%ProgramFiles(x86)%\2345Soft\2345Pic\protect\Pic_2345Svc.exe"
  • '%APPDATA%\2345pic\application\10.9.1.9791\2345picloader.exe' --rescue --invoke-point=1
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345pictool.exe' -update-force-config
  • '%ProgramFiles(x86)%\2345soft\2345pic\protect\pic_2345svc.exe'
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picloader.exe' -skinselected 0
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picupdate.exe' -install
  • '%ProgramFiles(x86)%\2345soft\2345pic\2345picupdate.exe' -SendUIStatNow
  • '%APPDATA%\2345pic\application\10.9.1.9791\2345picloader.exe' -check-thumbnail
  • '%APPDATA%\2345pic\application\10.9.1.9791\2345picloader.exe' -check-pdfconverter
  • '%APPDATA%\2345pic\application\10.9.1.9791\2345picloader.exe' -check-ocr
  • '%APPDATA%\2345pic\pdfeditor\launcher\launcher.exe' --mode=pdfeditor_update
Executes the following
  • '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\2345Soft\2345Pic\2345ImageThumb64.dll"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play