Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKLM>\SOFTWARE\FileZilla Client]
- [<HKCU>\Software\FileZilla Client]
- [<HKLM>\SOFTWARE\RIT\The Bat!]
- [<HKCU>\Software\RIT\The Bat!]
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\data\reg organizer_cu\knownstartupitemsv3.zip
- %TEMP%\nsv6af3.tmp\newadvsplash.dll
- %TEMP%\nsv6af3.tmp\splash.jpg
- %TEMP%\nsv6af3.tmp\junction.exe
- %TEMP%\nsv6af3.tmp\registry.dll
- %TEMP%\nsv6af3.tmp\uac.dll
- %TEMP%\nsv6af3.tmp\system.dll
- %TEMP%\nsp6ad2.tmp
- %TEMP%\7zipsfx.000\app\reg organizer\winrtapps.dll
- %TEMP%\7zipsfx.000\app\reg organizer\winmm.dll
- %TEMP%\7zipsfx.000\app\reg organizer\sciter.dll
- %TEMP%\7zipsfx.000\app\reg organizer\quickregeditorlaunch.dll
- %TEMP%\7zipsfx.000\app\reg organizer\pyg.dll
- %TEMP%\7zipsfx.000\app\reg organizer\notifications.dll
- %TEMP%\7zipsfx.000\app\reg organizer\hardwareconstant.dll
- %TEMP%\7zipsfx.000\app\reg organizer\closeapplication.dll
- %TEMP%\7zipsfx.000\app\reg organizer\updater.exe
- %TEMP%\7zipsfx.000\app\reg organizer\startupcheckingservice.exe
- %TEMP%\7zipsfx.000\regorganizerportable.exe
- %TEMP%\7zipsfx.000\app\reg organizer\regorganizer.exe
- %TEMP%\7zipsfx.000\data\portableapps.comlauncherruntimedata-regorganizerportable.ini
- %TEMP%\nsv6af3.tmp\execdos.dll
- %TEMP%\regorganizerportabletemp\cab18ce.tmp
- %TEMP%\7zipsfx.000\app\reg organizer\regkey.ini
- %TEMP%\regorganizerportabletemp\tar18ae.tmp
- %TEMP%\regorganizerportabletemp\cab18ad.tmp
- %TEMP%\regorganizerportabletemp\tar188d.tmp
- %TEMP%\regorganizerportabletemp\cab188c.tmp
- %TEMP%\regorganizerportabletemp\tar12af.tmp
- %TEMP%\regorganizerportabletemp\cab12ae.tmp
- %TEMP%\regorganizerportabletemp\tar129d.tmp
- %TEMP%\regorganizerportabletemp\cab129c.tmp
- %TEMP%\regorganizerportabletemp\tar125c.tmp
- %TEMP%\regorganizerportabletemp\cab125b.tmp
- %TEMP%\regorganizerportabletemp\tard7a3.tmp
- %TEMP%\regorganizerportabletemp\cabd7a2.tmp
- %TEMP%\regorganizerportabletemp\tard59e.tmp
- %TEMP%\regorganizerportabletemp\cabd59d.tmp
- %TEMP%\regorganizerportabletemp\tard58c.tmp
- %TEMP%\regorganizerportabletemp\cabd58b.tmp
- %TEMP%\regorganizerportabletemp\tard56b.tmp
- %TEMP%\regorganizerportabletemp\cabd56a.tmp
- %LOCALAPPDATA%\chemtable software\reg organizer\tweaks.log
- %TEMP%\7zipsfx.000\app\reg organizer\reg64call.exe
- %TEMP%\nsv6af3.tmp\runtimedata.ini
- %TEMP%\7zipsfx.000\app\reg organizer\helperfor64bits.exe
- %TEMP%\7zipsfx.000\data\shared\startupitems\tdriversfactory.xml
- %TEMP%\7zipsfx.000\app\reg organizer\links.xml
- %TEMP%\7zipsfx.000\data\reg organizer_cu\ignoreregcleaner.xml
- %TEMP%\7zipsfx.000\app\reg organizer\ignoreregcleaner.bkp.xml
- %TEMP%\7zipsfx.000\data\reg organizer_cu\cleanupignore.xml
- %TEMP%\7zipsfx.000\app\reg organizer\cleanupignore.bkp.xml
- %TEMP%\7zipsfx.000\data\shared\cleanup.xml
- %TEMP%\7zipsfx.000\data\reg organizer_local\cachewebhelperupdates.xml
- %TEMP%\7zipsfx.000\app\reg organizer\appuninstignore.bkp.xml
- %TEMP%\7zipsfx.000\data\reg organizer_local\additionalstartupitemsdata.xml
- %TEMP%\7zipsfx.000\data\reg organizer_cu\listshistory.bin
- %TEMP%\7zipsfx.000\data\reg organizer_local\appscache.bin
- %TEMP%\7zipsfx.000\app\appinfo\appicon.ico
- %TEMP%\7zipsfx.000\app\appinfo\appicon_32.png
- %TEMP%\7zipsfx.000\app\appinfo\appicon_16.png
- %TEMP%\7zipsfx.000\app\appinfo\appicon_128.png
- %TEMP%\7zipsfx.000\data\reg organizer_local\notificationstmp\3744734993_-1.png
- %TEMP%\7zipsfx.000\app\reg organizer\documentation\russian\documentation.chm
- %TEMP%\7zipsfx.000\app\reg organizer\documentation\english\documentation.chm
- %TEMP%\7zipsfx.000\app\reg organizer\optimizationanimation.avi
- %TEMP%\7zipsfx.000\data\reg organizer_local\privacycleanup.xml
- %TEMP%\7zipsfx.000\data\shared\startupitems\tscheduleratsystemstartupfactory\tscheduleratsystemstartupfactory.xml
- %TEMP%\7zipsfx.000\app\reg organizer\languages\korean-8.30.sib
- %TEMP%\7zipsfx.000\data\shared\startupitems\tschedulerfactory\tschedulerfactory.xml
- %TEMP%\7zipsfx.000\app\reg organizer\languages\korean-8.30 beta 2.sib
- %TEMP%\7zipsfx.000\data\reg organizer_local\tweaks.log
- %TEMP%\7zipsfx.000\app\reg organizer\undoingchangescenterunit.const
- %TEMP%\7zipsfx.000\app\reg organizer\programdatastorage.const
- %TEMP%\7zipsfx.000\data\settings\regorganizerportablesettings.ini
- %TEMP%\7zipsfx.000\app\appinfo\appinfo.ini
- %TEMP%\7zipsfx.000\data\settings\regorganizerportable.reg
- %TEMP%\7zipsfx.000\app\reg organizer\whatsnew.txt
- %TEMP%\7zipsfx.000\app\reg organizer\whatsnew-russian.txt
- %TEMP%\7zipsfx.000\app\reg organizer\readme.txt
- %TEMP%\7zipsfx.000\app\reg organizer\readme-russian.txt
- %TEMP%\7zipsfx.000\app\reg organizer\readme-french.txt
- %TEMP%\7zipsfx.000\app\reg organizer\license.txt
- %TEMP%\7zipsfx.000\app\reg organizer\license-russian.txt
- %TEMP%\7zipsfx.000\app\reg organizer\license-french.txt
- %TEMP%\7zipsfx.000\data\reg organizer_local\deletedapps\apps.txt
- %TEMP%\7zipsfx.000\data\reg organizer_cu\tweaks.xml
- %TEMP%\7zipsfx.000\app\reg organizer\tweaks.bkp.xml
- %TEMP%\7zipsfx.000\data\shared\startupitems\tservicesfactory.xml
- %TEMP%\7zipsfx.000\data\reg organizer_local\undochangescenter\data.uccdata
- %TEMP%\regorganizerportabletemp\tar18cf.tmp
Deletes the following files
- %TEMP%\regorganizerportabletemp\cabd56a.tmp
- %TEMP%\regorganizerportabletemp\tar18ae.tmp
- %TEMP%\regorganizerportabletemp\cab18ad.tmp
- %TEMP%\regorganizerportabletemp\tar188d.tmp
- %TEMP%\regorganizerportabletemp\cab188c.tmp
- %TEMP%\regorganizerportabletemp\tar12af.tmp
- %TEMP%\regorganizerportabletemp\cab12ae.tmp
- %TEMP%\regorganizerportabletemp\tar129d.tmp
- %TEMP%\regorganizerportabletemp\cab129c.tmp
- %TEMP%\regorganizerportabletemp\tar125c.tmp
- %TEMP%\regorganizerportabletemp\cab125b.tmp
- %TEMP%\regorganizerportabletemp\tard7a3.tmp
- %TEMP%\regorganizerportabletemp\cabd7a2.tmp
- %TEMP%\regorganizerportabletemp\tard59e.tmp
- %TEMP%\regorganizerportabletemp\cabd59d.tmp
- %TEMP%\regorganizerportabletemp\tard58c.tmp
- %TEMP%\regorganizerportabletemp\cabd58b.tmp
- %TEMP%\regorganizerportabletemp\tard56b.tmp
- %TEMP%\regorganizerportabletemp\cab18ce.tmp
- %TEMP%\regorganizerportabletemp\tar18cf.tmp
Network activity
Connects to
- 'tr####.#hemtable-cloud.com':80
TCP
- 'ch###able.com':443
UDP
- DNS ASK st#####.chemtable-cloud.com
- DNS ASK ch###able.com
- DNS ASK la###helper.com
- DNS ASK ca###.##emtable-cloud.com
- DNS ASK tr####.#hemtable-cloud.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\regorganizerportable.exe'
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%APPDATA%\ChemTable Software\Reg Organizer" "%TEMP%\7ZipSfx.000\Data\Reg Organizer_CU"
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\Reg Organizer" "%TEMP%\7ZipSfx.000\Data\Reg Organizer_Local"
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\Shared" "%TEMP%\7ZipSfx.000\Data\Shared"
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\InstallerTracing" "%TEMP%\7ZipSfx.000\Data\InstallerTracing"
- '%TEMP%\7zipsfx.000\app\reg organizer\regorganizer.exe'
- '%TEMP%\7zipsfx.000\app\reg organizer\reg64call.exe' RegFunc64_10bb62_2c0b
- '%TEMP%\7zipsfx.000\app\reg organizer\helperfor64bits.exe' CleanCache CleanCacheExecute-1-0-c65f4299
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%APPDATA%\ChemTable Software\Reg Organizer" "%TEMP%\7ZipSfx.000\Data\Reg Organizer_CU"' (with hidden window)
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\Reg Organizer" "%TEMP%\7ZipSfx.000\Data\Reg Organizer_Local"' (with hidden window)
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\Shared" "%TEMP%\7ZipSfx.000\Data\Shared"' (with hidden window)
- '%TEMP%\nsv6af3.tmp\junction.exe' -accepteula -q "%LOCALAPPDATA%\ChemTable Software\InstallerTracing" "%TEMP%\7ZipSfx.000\Data\InstallerTracing"' (with hidden window)
