Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im "RegOrganizer.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\32.exe
- %ProgramFiles%\reg organizer\is-1l2sb.tmp
- %ProgramFiles%\reg organizer\shell\is-uutq7.tmp
- %ProgramFiles%\reg organizer\shell\is-h2m9p.tmp
- %ProgramFiles%\reg organizer\shell\is-pkhqq.tmp
- %ProgramFiles%\reg organizer\languages\is-2k908.tmp
- %ProgramFiles%\reg organizer\is-8b8co.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\reg organizer.lnk
- C:\users\public\desktop\reg organizer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\uninstall reg organizer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\user's manual.lnk
- %ProgramFiles%\reg organizer\unins000.dat
- %TEMP%\etilqs_cm2f3x6qspxb1bn
- %ALLUSERSPROFILE%\chemtable software\shared\startupcheckingservice.log
- %ProgramFiles%\reg organizer\version.dll
- %TEMP%\etilqs_sgcrpg7fvuqqbth
- %TEMP%\etilqs_hvlsux26dbd7qbu
- %TEMP%\etilqs_dmwbpm8hvb153bw
- %TEMP%\etilqs_kunowdzbclofycn
- %TEMP%\etilqs_hbtykrjqnbhvhun
- %TEMP%\etilqs_vfdrdmxxemvgfqf
- %TEMP%\etilqs_tejcrag7wyn6ofa
- %TEMP%\etilqs_sl80rmuekcp0z3f
- %ProgramFiles%\reg organizer\is-45847.tmp
- %ProgramFiles%\reg organizer\unins000.msg
- %ProgramFiles%\reg organizer\is-939ml.tmp
- %ProgramFiles%\reg organizer\is-ienml.tmp
- %TEMP%\rarsfx0\32or64.cmd
- %TEMP%\rarsfx0\64.exe
- %TEMP%\rarsfx0\absba.url
- %TEMP%\rarsfx0\reg-organizer-setup.exe
- %TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp
- %TEMP%\is-04t2u.tmp\_isetup\_setup64.tmp
- %TEMP%\is-04t2u.tmp\closeapplication.dll
- %ProgramFiles%\reg organizer\is-lhog4.tmp
- %LOCALAPPDATA%\chemtable software\reg organizer\is-l8i0b.tmp
- %ProgramFiles%\reg organizer\is-u1bom.tmp
- %ProgramFiles%\reg organizer\is-mkj1l.tmp
- %ProgramFiles%\reg organizer\is-g0d1j.tmp
- %ProgramFiles%\reg organizer\is-au22t.tmp
- %ProgramFiles%\reg organizer\is-1sksf.tmp
- %ProgramFiles%\reg organizer\is-qt0sf.tmp
- %ProgramFiles%\reg organizer\is-9catr.tmp
- %ProgramFiles%\reg organizer\is-c5bav.tmp
- %ProgramFiles%\reg organizer\is-mesbq.tmp
- %ProgramFiles%\reg organizer\documentation\english\is-q44c7.tmp
- %ProgramFiles%\reg organizer\documentation\russian\is-geirh.tmp
- %ProgramFiles%\reg organizer\is-rp3aa.tmp
- %ProgramFiles%\reg organizer\is-d75vf.tmp
- %ProgramFiles%\reg organizer\is-dsp5d.tmp
- %TEMP%\etilqs_8hqu2pfpwusfafr
Удаляет следующие файлы
- %TEMP%\is-04t2u.tmp\closeapplication.dll
- %TEMP%\is-04t2u.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp
Перемещает следующие файлы
- %ProgramFiles%\reg organizer\is-lhog4.tmp в %ProgramFiles%\reg organizer\unins000.exe
- %ProgramFiles%\reg organizer\shell\is-pkhqq.tmp в %ProgramFiles%\reg organizer\shell\shellcontextmenu_4.dll
- %ProgramFiles%\reg organizer\shell\is-h2m9p.tmp в %ProgramFiles%\reg organizer\shell\shellcontextmenuinstallerro.msix
- %ProgramFiles%\reg organizer\shell\is-uutq7.tmp в %ProgramFiles%\reg organizer\shell\shellcontextmenuinstaller.exe
- %ProgramFiles%\reg organizer\is-1l2sb.tmp в %ProgramFiles%\reg organizer\winrtapps.dll
- %ProgramFiles%\reg organizer\is-45847.tmp в %ProgramFiles%\reg organizer\startupcheckingservice.exe
- %ProgramFiles%\reg organizer\is-939ml.tmp в %ProgramFiles%\reg organizer\sciter.dll
- %ProgramFiles%\reg organizer\is-dsp5d.tmp в %ProgramFiles%\reg organizer\notifications.dll
- %ProgramFiles%\reg organizer\is-g0d1j.tmp в %ProgramFiles%\reg organizer\launcher.exe
- %ProgramFiles%\reg organizer\is-d75vf.tmp в %ProgramFiles%\reg organizer\hardwareconstant.dll
- %ProgramFiles%\reg organizer\is-rp3aa.tmp в %ProgramFiles%\reg organizer\regorganizer.exe
- %ProgramFiles%\reg organizer\languages\is-2k908.tmp в %ProgramFiles%\reg organizer\languages\russian.sib
- %ProgramFiles%\reg organizer\documentation\russian\is-geirh.tmp в %ProgramFiles%\reg organizer\documentation\russian\documentation.chm
- %ProgramFiles%\reg organizer\is-mesbq.tmp в %ProgramFiles%\reg organizer\tweaks.bkp.xml
- %ProgramFiles%\reg organizer\is-c5bav.tmp в %ProgramFiles%\reg organizer\tracesprofiles.bin
- %ProgramFiles%\reg organizer\is-9catr.tmp в %ProgramFiles%\reg organizer\ignoreregcleaner.bkp.xml
- %ProgramFiles%\reg organizer\is-qt0sf.tmp в %ProgramFiles%\reg organizer\cleanupignore.bkp.xml
- %ProgramFiles%\reg organizer\is-1sksf.tmp в %ProgramFiles%\reg organizer\appuninstignore.bkp.xml
- %ProgramFiles%\reg organizer\is-au22t.tmp в %ProgramFiles%\reg organizer\whatsnew.txt
- %ProgramFiles%\reg organizer\is-mkj1l.tmp в %ProgramFiles%\reg organizer\license.txt
- %ProgramFiles%\reg organizer\is-ienml.tmp в %ProgramFiles%\reg organizer\readme.txt
- %ProgramFiles%\reg organizer\is-u1bom.tmp в %ProgramFiles%\reg organizer\closeapplication.dll
- %LOCALAPPDATA%\chemtable software\reg organizer\is-l8i0b.tmp в %LOCALAPPDATA%\chemtable software\reg organizer\appscache.bin
- %ProgramFiles%\reg organizer\documentation\english\is-q44c7.tmp в %ProgramFiles%\reg organizer\documentation\english\documentation.chm
- %ProgramFiles%\reg organizer\is-8b8co.tmp в %ProgramFiles%\reg organizer\links.xml
Сетевая активность
Подключается к
- 'au######te.geo.opera.com':80
- 'tw##ter.com':80
- 'ro###.ebay.com':443
- 'ro###.ebay.com':80
- 'x1.#.lencr.org':80
- 'sd#####es.operacdn.com':443
- 'fz###.ttk.ru':80
- 'fa###ook.com':80
- 'ya###.opera.com':80
- 'ch###able.com':443
- 'ab##a.cc':80
- 'si#####ck2.opera.com':443
- 'si#####ck2.opera.com':80
- 're###.opera.com':80
- 'en.###ipedia.org':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'bing.com':80
- 'du###uckgo.com':443
- 'se####.yahoo.com':80
- 'am##on.com':80
- 'google.com':80
- 'au######te.geo.opera.com':443
- 'bl#####st.rkn.gov.ru':80
- 'bl#####st.rkn.gov.ru':443
TCP
Запросы HTTP GET
- http://au######te.geo.opera.com/geolocation/
- http://www.tw##ter.com/?pa################
- http://www.ya##o.com/?il#####
- http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
- http://x1.#.lencr.org/
- http://re###.opera.com/speeddials/partner/wikipedia_org_us
- http://re###.opera.com/speeddials/partner/youtube
- http://re###.opera.com/speeddials/partner/product
- http://re###.opera.com/speeddials/partner/booking_com_us
- http://re###.opera.com/speeddials/partner/twitter_us
- http://re###.opera.com/speeddials/partner/yahoo
- http://re###.opera.com/speeddials/partner/ebay_us
- http://re###.opera.com/speeddials/partner/amazon_us
- http://re###.opera.com/favicon.ico
- http://fz###.ttk.ru/favicon.ico
- http://fz###.ttk.ru/fz139/?or####################################
- http://fz###.ttk.ru/?or####################################
- http://www.fa###ook.com/campaign/landing.php?ca#########################
- http://re###.opera.com/speeddials/partner/facebook
- http://ya###.opera.com/favicon.ico
- http://si#####ck2.opera.com/?ho################################################
- http://si#####ck2.opera.com/?ho###################################################
- http://re###.opera.com/www.opera.com/firstrun/
- http://en.###ipedia.org/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://se####.yahoo.com/favicon.ico
- http://www.am##on.com/favicon.ico
- http://www.google.com/favicon.ico
- http://bl#####st.rkn.gov.ru/
- http://bl#####st.rkn.gov.ru/DDoS01/ba5f08b1/
Другие
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
- 'si#####ck2.opera.com':443
- 'ch###able.com':443
- 'ya###.opera.com':443
- 'sd#####es.operacdn.com':443
- 'op##a.com':443
- 'ro###.ebay.com':443
- 'ya##o.com':443
- 'bl#####st.rkn.gov.ru':443
UDP
- DNS ASK google.com
- DNS ASK ya##o.com
- DNS ASK ro###.ebay.com
- DNS ASK x1.#.lencr.org
- DNS ASK sd#####es.operacdn.com
- DNS ASK fz###.ttk.ru
- DNS ASK fa###ook.com
- DNS ASK op##a.com
- DNS ASK ya###.opera.com
- DNS ASK ch###able.com
- DNS ASK ab##a.cc
- DNS ASK re###.opera.com
- DNS ASK si#####ck2.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK bi##.#ikimedia.org
- DNS ASK bing.com
- DNS ASK am##on.com
- DNS ASK du###uckgo.com
- DNS ASK se####.yahoo.com
- DNS ASK au######te.geo.opera.com
- DNS ASK tw##ter.com
- DNS ASK bl#####st.rkn.gov.ru
Другое
Ищет следующие окна
- ClassName: 'Edit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\reg-organizer-setup.exe' /verysilent
- '%TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp' /SL5="$1025A,25404699,832512,%TEMP%\RarSFX0\reg-organizer-setup.exe" /verysilent
- '%ProgramFiles%\reg organizer\startupcheckingservice.exe' start
- '%ProgramFiles%\reg organizer\regorganizer.exe'
- '%TEMP%\rarsfx0\64.exe'
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Reg Organizer\Shell\ShellContextMenu_4.dll"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1196.0.1846502252\650051415" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.12.50661881\1226228378" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.11.1867282061\563942557" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.10.350412142\1593679460" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.9.3162766\642604384" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.8.409003452\1286715183" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.7.656800506\1208333125" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.6.80005962\611069453" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2748.4.1575820134\1936149520" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2860
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.5.38725475\1222187861" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.absba.cc/ /crash-reporter-parent-id=1196
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.4.1575820134\1936149520" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.absba.cc/
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.absba.cc/"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '<SYSTEM32>\reg.exe' add "HKCU\Software\ChemTable Software\Reg Organizer" /v "LicenseKeys" /t REG_SZ /d "AAGKN5-MA967U-5LZSKF-VFK29W-49J4WJ-8ARKUN-RQGJQ6-BSFPA7-EDPA" /f (со скрытым окном)
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2748.0.2081793105\1501500108" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" " (со скрытым окном)
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71 /crash-reporter-parent-id=2748
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71"
- '<SYSTEM32>\schtasks.exe' /Delete /TN "RegOrganizerQuickLaunch" /F (со скрытым окном)
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.16.2012107815\155826819" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.17.2088063210\669567035" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\taskkill.exe' /f /im "RegOrganizer.exe" (со скрытым окном)
- '%ProgramFiles%\reg organizer\startupcheckingservice.exe' start (со скрытым окном)
