Traffic Exchange

Threat Scorecard

Ranking: 49
Threat Level: 10 % (Normal)
Infected Computers: 1,000,701
First Seen: November 11, 2016
Last Seen: September 21, 2023
OS(es) Affected: Windows

The Traffic Exchange software from Microleaves Ltd may be promoted to PC users as a type of shopping enhancer that connects the users to ad publishers directly. The Traffic Exchange application can be installed on Windows-powered computers for free, and you may be lead to believe that the Traffic Exchange provides betters deals on your favorite online shops. PC users may be invited to install the Traffic Exchange program and benefit from personalized discounts, promotions, limited-time deals and exclusive offers. The Traffic Exchange application from Microleaves Ltd is classified as a Potentially Unwanted Program (PUP). The Traffic Exchange software is known to promote questionable computer support companies, invite users to install unreliable cybersecurity tools and run from 'C:\Windows\fvxeupdate.exe.' The program at hand may drop files in the following locations:

C:\Microleaves\Online Application Installer\prerequisites\Traffic Exchange.exe
C:\Microleaves\Online Application Installer\prerequisites\aipackagechainer.exe
C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian.exe
C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.exe
C:\Windows\System32\Tasks\Online Application Updater
C:\Windows\System32\Tasks\Online Application v2 Guard
C:\Windows\System32\Tasks\Online Application v2 OG

The Traffic Exchange program may add scheduled tasks in Windows and connect to ad servers every five minutes. The ads by Traffic Exchange may be presented in pop-up windows, floating ad boxes and may show up as hyperlinked text on pages. Security scanners may mark the Traffic Exchange software as 'PUP.Optional.OnlineIO' and 'Adware.TrafficExchange'. The content loaded by the Traffic Exchange in the browser might include links to phishing pages and insecure pages. It is advised to consider the Traffic Exchange for removal with a trusted anti-malware utility.

SpyHunter Detects & Remove Traffic Exchange

File System Details

Traffic Exchange may create the following file(s):
# File Name MD5 Detections
1. file.exe 68ceb16a7351390eb1c5a4cb759a3dcb 2,169
2. Online-Guardian.exe e2ff45dbd8c1301942569abab2c4986e 7
3. Online-Guardian.exe 0273dfccfd4cbd4c4bdad00c16dbcbd1 3
4. Online-Guardian.exe 72b85eaac711dc75d4377780939a21d9 3
5. Online-Guardian.exe fb9ba70b32188c1dc720437f18827c59 2
6. Online-Guardian.exe 2c732b6f40c8c9572fcd56e13849fe04 2
7. Online-Guardian.exe bb86c068ca095caa219c161a5f75d6a8 2
8. Online-Guardian.exe b1956bcc37f7b28bc8ad2efd16060c87 2
9. Online-Guardian.exe eaeac3df96a3510d2de7e0b007523baa 1
10. Online-Guardian.exe 5fa33586c809418cc9c3a2a0eae3ec38 1
11. Online-Guardian.exe 54f9436ef25d477de78b4a9f18f66346 1
12. Online-Guardian.exe f4d9dc69cef89815ce21a5a4286b29b9 1
13. Online Application Updater.exe 016ce1783d079384774fb3ffee95c169 1
14. Online-Guardian.exe 86638a648d262f44e86f98c3a259feba 1
15. Online-Guardian.exe afce36dd1047fd9f6c321d20b5587590 1
16. file.exe a245cce70a4d34a928af302561cb6f77 0
17. file.exe 706341e3da40e89afc3cc28982f5d4f6 0
18. file.exe 36364ac694259372f98cda97b4cf3bf6 0
19. file.exe f9ea9d53ced081dfaaaca7de2af97070 0
20. file.exe 826bc01269c5ff5dfdb932d04ca8785e 0
21. file.exe 10a5006704bd57c75ef592704e9c916c 0
22. file.exe b65ce73e28cb291a327bbe3314017d06 0
23. file.exe fa5373f0c81960ec7a58ef75cbd04878 0
24. file.exe 52dd542eeadf3ba7cd4a4c93a9202041 0
25. file.exe 42dddffbf0061cc69c35dc8766aea3c6 0
26. file.exe f4e4f42c67b203581ad6078384bc4ca5 0
27. file.exe 9a3715a18e4a0e988895c5bd8363d5d6 0
28. file.exe 1ae34060ed111aec2e3c914270ef6131 0
More files

Registry Details

Traffic Exchange may create the following registry entry or registry entries:
Regexp file mask
%TEMP%\ww-Online.IO-installer.exe
%WINDIR%\Installer\{010F762A-8645-4AAE-9E69-40254D5147F9}\online.exe
%WINDIR%\Installer\{92C1F287-B8A1-415C-B872-4000F57C055A}\online.exe
%WINDIR%\System32\Tasks\Online Application V2Gd
%WINDIR%\System32\Tasks\Online Special Application[RANDOM CHARACTERS]
%WINDIR%\System32\Tasks\Traffic Exchange[RANDOM CHARACTERS]
%WINDIR%\System32\Tasks\Updater_Online_Application
%WINDIR%\System32\Tasks\Updater_Online_Special_Application[RANDOM CHARACTERS]
%WINDIR%\Tasks\Online Application V2Gd.job
%WINDIR%\Tasks\Online Special Application[RANDOM CHARACTERS].job
%WINDIR%\Tasks\Traffic Exchange[RANDOM CHARACTERS].job
%WINDIR%\Tasks\Updater_Online_Application.job
%WINDIR%\Tasks\Updater_Online_Special_Application[RANDOM CHARACTERS].job
SOFTWARE\Caphyon\Advanced Installer\LZMA\{010F762A-8645-4AAE-9E69-40254D5147F9}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{438465C5-D78D-4958-B31D-60374B5042F4}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{52F7BE5C-2C3B-4C7B-A96D-F19B9EC1992D}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{92C1F287-B8A1-415C-B872-4000F57C055A}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{DBABED16-1BB7-4805-B24B-7424A372AB0F}
SOFTWARE\Caphyon\Advanced Installer\LZMA\{F0847AE0-465A-4D7B-A555-AABB43B550F0}
SOFTWARE\Caphyon\Advanced Installer\Scheduled Tasks\{F039D4A9-14D3-4425-A4FA-F2F9D5B0E014}
SOFTWARE\Classes\Installer\Products\436F6625D7B77354DBCD89DDC6CFAB1A
SOFTWARE\Classes\Installer\Products\5C564834D87D85943BD10673B405244F
SOFTWARE\Classes\Installer\Products\61DEBABD7BB150842BB447423A27BAF0
SOFTWARE\Classes\Installer\Products\6F4136C48ED2453458A6876797EA4F70
SOFTWARE\Classes\Installer\Products\782F1C291A8BC5148B2704005FC750A5
SOFTWARE\Classes\Installer\Products\A267F0105468EAA4E9960452D415749F
SOFTWARE\Classes\Installer\Products\C5EB7F25B3C2B7C49AD61FB9E91C99D2
SOFTWARE\Classes\Installer\UpgradeCodes\A3B7F0A2A2BF143479D11833E902B61F
SOFTWARE\Microleaves
SOFTWARE\Microsoft\Tracing\Online Application Updater_RASAPI32
SOFTWARE\Microsoft\Tracing\Online Application Updater_RASMANCS
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Online Special Application V2G1
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Online Special Application V2G2
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Online Special Application V2G3
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Traffic Exchange Updater
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater_Online_Application
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater_Online_Special_Application
SOFTWARE\WOW6432Node\Caphyon\Advanced Installer\LZMA\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}
SOFTWARE\Wow6432Node\Caphyon\Advanced Installer\Scheduled Tasks\{F039D4A9-14D3-4425-A4FA-F2F9D5B0E014}
SOFTWARE\WOW6432Node\Microleaves
Online.IO
{010F762A-8645-4AAE-9E69-40254D5147F9}
{102BD58E-AC7E-47DB-B2AB-4A444FFF82CF}
{438465C5-D78D-4958-B31D-60374B5042F4}
{44FE85D7-4C36-4A76-A3CF-2BFFEBB76C09}
{4C6314F6-2DE8-4354-856A-787679AEF407}
{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}
{52F7BE5C-2C3B-4C7B-A96D-F19B9EC1992D}
{57281722-3238-4A30-AAE7-85D93977E0FE}
{57629D30-3D4C-4BA3-9EE2-D38E56D7221E}
{5C2B5FB4-B961-4BA8-AAC5-11381225A8FA}
{804C6085-8AFA-452E-8567-55FE1BF21FBF}
{92C1F287-B8A1-415C-B872-4000F57C055A}
{A91EEA9B-DCAA-4B2D-B62A-50B8EA351561}
{DBABED16-1BB7-4805-B24B-7424A372AB0F}
{E7B046D6-CF45-4063-9BB8-DE124614885C}
{F0847AE0-465A-4D7B-A555-AABB43B550F0}
{F972E1E6-EE44-4BE6-8264-4B88ED176BDA}

Directories

Traffic Exchange may create the following directory or directories:

%ALLUSERSPROFILE%\Microleaves
%APPDATA%\Microleaves
%HOMEDRIVE%\AppData\Roaming\Microleaves
%HOMEDRIVE%\Users\Default\AppData\Local\AdvinstAnalytics
%LOCALAPPDATA%\AdvinstAnalytics
%PROGRAMFILES%\Microleaves
%PROGRAMFILES%\Online-IO
%PROGRAMFILES%\Online.IO
%PROGRAMFILES(x86)%\Microleaves
%PROGRAMFILES(x86)%\Online-IO
%PROGRAMFILES(x86)%\Online.IO
%USERPROFILE%\Local Settings\Application Data\AdvinstAnalytics
%WINDIR%\INSTALLER\{52F7BE5C-2C3B-4C7B-A96D-F19B9EC1992D}
%WINDIR%\INSTALLER\{F0847AE0-465A-4D7B-A555-AABB43B550F0}
%WINDIR%\Installer\{438465C5-D78D-4958-B31D-60374B5042F4}
%WINDIR%\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}
%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics
%WINDIR%\System32\config\systemprofile\AppData\Local\AdvinstAnalytics
%WINDIR%\system32\config\systemprofile\AppData\Roaming\Microleaves
%WINDIR%\syswow64\config\systemprofile\AppData\Roaming\Microleaves

Trending

Most Viewed

Loading...