Adware.Downware.1353

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\RegClean Pro\Cloud_Backup_Setup.exe' /S
'%TEMP%\BackupSetup.exe' /S
'%PROGRAM_FILES%\RegClean Pro\RegCleanPro.exe' babylon
'%TEMP%\RegClean2.exe' /verysilent
'%TEMP%\is-NJNJ2.tmp\RegClean2.tmp' /SL5="$3002A,3850014,136704,%TEMP%\RegClean2.exe" /verysilent
'%TEMP%\BackupSetup.exe' (загружен из сети Интернет)

Запускает на исполнение:

'<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\jscript.dll"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\RegClean Pro\is-ONTMN.tmp
%PROGRAM_FILES%\RegClean Pro\is-S5RE5.tmp
%PROGRAM_FILES%\RegClean Pro\is-P4EO9.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro\RegClean Pro.lnk
%PROGRAM_FILES%\RegClean Pro\is-PBUIB.tmp
%PROGRAM_FILES%\RegClean Pro\is-SCV9P.tmp
%PROGRAM_FILES%\RegClean Pro\is-C9VFE.tmp
%PROGRAM_FILES%\RegClean Pro\is-5QROQ.tmp
%PROGRAM_FILES%\RegClean Pro\is-O6THA.tmp
%PROGRAM_FILES%\RegClean Pro\is-TITTV.tmp
%PROGRAM_FILES%\RegClean Pro\is-KM0BB.tmp
%PROGRAM_FILES%\RegClean Pro\is-A7OMS.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro\Register RegClean Pro.lnk
%TEMP%\nsxB2BC.tmp\NSISdl.dll
%TEMP%\aff.conf
<SYSTEM32>\roboot.exe
%TEMP%\ping.txt
%TEMP%\BackupSetup.exe
%TEMP%\nsn8A36.tmp\NSISdl.dll
%PROGRAM_FILES%\RegClean Pro\unins000.msg
C:\Users\Public\Desktop\RegClean Pro.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro\Uninstall RegClean Pro.lnk
%TEMP%\is-4MBVI.tmp\roboot.exe
%PROGRAM_FILES%\RegClean Pro\unins000.dat
%PROGRAM_FILES%\RegClean Pro\is-0GFVS.tmp
%PROGRAM_FILES%\RegClean Pro\is-UCPOV.tmp
%PROGRAM_FILES%\RegClean Pro\is-BOPJA.tmp
%PROGRAM_FILES%\RegClean Pro\is-O0SSQ.tmp
%PROGRAM_FILES%\RegClean Pro\is-C92NH.tmp
%PROGRAM_FILES%\RegClean Pro\is-TPJJF.tmp
%PROGRAM_FILES%\RegClean Pro\is-4SLVG.tmp
%TEMP%\is-NJNJ2.tmp\RegClean2.tmp
%TEMP%\nsn8A36.tmp\Registry.dll
%TEMP%\RegClean2.exe
%TEMP%\is-4MBVI.tmp\setup_en.bmp
%TEMP%\is-4MBVI.tmp\pcbackup.bmp
%TEMP%\is-4MBVI.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\RegClean Pro\is-DOTD2.tmp
%PROGRAM_FILES%\RegClean Pro\is-RFK7C.tmp
%PROGRAM_FILES%\RegClean Pro\is-7K6QB.tmp
%PROGRAM_FILES%\RegClean Pro\is-PU2NC.tmp
%PROGRAM_FILES%\RegClean Pro\is-9E8T1.tmp
%PROGRAM_FILES%\RegClean Pro\is-P92EH.tmp
%PROGRAM_FILES%\RegClean Pro\is-6URVS.tmp
%PROGRAM_FILES%\RegClean Pro\is-4KMFK.tmp
%PROGRAM_FILES%\RegClean Pro\is-AFONM.tmp
%PROGRAM_FILES%\RegClean Pro\is-MTLUU.tmp
%PROGRAM_FILES%\RegClean Pro\is-LJN28.tmp
%PROGRAM_FILES%\RegClean Pro\is-PDSFL.tmp
%PROGRAM_FILES%\RegClean Pro\is-H62KJ.tmp

Удаляет следующие файлы:

%TEMP%\nsxB2BC.tmp\NSISdl.dll
%TEMP%\is-NJNJ2.tmp\RegClean2.tmp
%TEMP%\nsn8A36.tmp\Registry.dll
%TEMP%\nsn8A36.tmp\NSISdl.dll
%TEMP%\is-4MBVI.tmp\roboot.exe
%TEMP%\is-4MBVI.tmp\pcbackup.bmp
%TEMP%\is-4MBVI.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4MBVI.tmp\setup_en.bmp

Перемещает следующие файлы:

%PROGRAM_FILES%\RegClean Pro\is-O6THA.tmp в %PROGRAM_FILES%\RegClean Pro\Spanish_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-5QROQ.tmp в %PROGRAM_FILES%\RegClean Pro\Swedish_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-C9VFE.tmp в %PROGRAM_FILES%\RegClean Pro\Finnish_rcp_fi.ini
%PROGRAM_FILES%\RegClean Pro\is-0GFVS.tmp в %PROGRAM_FILES%\RegClean Pro\Portuguese_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-6URVS.tmp в %PROGRAM_FILES%\RegClean Pro\Italian_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-P92EH.tmp в %PROGRAM_FILES%\RegClean Pro\Japanese_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-9E8T1.tmp в %PROGRAM_FILES%\RegClean Pro\Norwegian_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-A7OMS.tmp в %PROGRAM_FILES%\RegClean Pro\portugese_rcp_pt.ini
%PROGRAM_FILES%\RegClean Pro\is-ONTMN.tmp в %PROGRAM_FILES%\RegClean Pro\korean_rcp_ko.ini
%PROGRAM_FILES%\RegClean Pro\is-SCV9P.tmp в %PROGRAM_FILES%\RegClean Pro\TraditionalCn_rcp_zh-tw.ini
%PROGRAM_FILES%\RegClean Pro\is-PBUIB.tmp в %PROGRAM_FILES%\RegClean Pro\xmllite.dll
%PROGRAM_FILES%\RegClean Pro\is-S5RE5.tmp в %PROGRAM_FILES%\RegClean Pro\polish_rcp_pl.ini
%PROGRAM_FILES%\RegClean Pro\is-KM0BB.tmp в %PROGRAM_FILES%\RegClean Pro\russian_rcp_ru.ini
%PROGRAM_FILES%\RegClean Pro\is-TITTV.tmp в %PROGRAM_FILES%\RegClean Pro\greek_rcp_el.ini
%PROGRAM_FILES%\RegClean Pro\is-P4EO9.tmp в %PROGRAM_FILES%\RegClean Pro\turkish_rcp_tr.ini
%PROGRAM_FILES%\RegClean Pro\is-RFK7C.tmp в %PROGRAM_FILES%\RegClean Pro\German_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-TPJJF.tmp в %PROGRAM_FILES%\RegClean Pro\isxdl.dll
%PROGRAM_FILES%\RegClean Pro\is-C92NH.tmp в %PROGRAM_FILES%\RegClean Pro\CleanSchedule.exe
%PROGRAM_FILES%\RegClean Pro\is-DOTD2.tmp в %PROGRAM_FILES%\RegClean Pro\RCPUninstall.exe
%PROGRAM_FILES%\RegClean Pro\is-4SLVG.tmp в %PROGRAM_FILES%\RegClean Pro\RegCleanPro.dll
%PROGRAM_FILES%\RegClean Pro\is-O0SSQ.tmp в %PROGRAM_FILES%\RegClean Pro\unins000.exe
%PROGRAM_FILES%\RegClean Pro\is-BOPJA.tmp в %PROGRAM_FILES%\RegClean Pro\RegCleanPro.exe
%PROGRAM_FILES%\RegClean Pro\is-UCPOV.tmp в %PROGRAM_FILES%\RegClean Pro\install_left_image.bmp
%PROGRAM_FILES%\RegClean Pro\is-MTLUU.tmp в %PROGRAM_FILES%\RegClean Pro\systweakasp.exe
%PROGRAM_FILES%\RegClean Pro\is-LJN28.tmp в %PROGRAM_FILES%\RegClean Pro\Dutch_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-PU2NC.tmp в %PROGRAM_FILES%\RegClean Pro\eng_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-7K6QB.tmp в %PROGRAM_FILES%\RegClean Pro\French_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-PDSFL.tmp в %PROGRAM_FILES%\RegClean Pro\Danish_rcp.ini
%PROGRAM_FILES%\RegClean Pro\is-AFONM.tmp в %PROGRAM_FILES%\RegClean Pro\Cloud_Backup_Setup.exe
%PROGRAM_FILES%\RegClean Pro\is-4KMFK.tmp в %PROGRAM_FILES%\RegClean Pro\Cloud_Backup_Setup_Intl.exe
%PROGRAM_FILES%\RegClean Pro\is-H62KJ.tmp в %PROGRAM_FILES%\RegClean Pro\Chinese_rcp.ini

Сетевая активность:

Подключается к:

'in#####.outbrowse.com':80
'tr###.#ypcbackup.com':80

TCP:

Запросы HTTP GET:

in#####.outbrowse.com/installTrack.php?pu##############################################################################
tr###.#ypcbackup.com/8695a4a3/systweakinstall/MyPCBackup_Setup.exe

UDP: