Technical Information
Modifies file system
Creates the following files
- %TEMP%\7zs893fbc91\app.ico
- %TEMP%\7zs893fbc91\mydownloader.core.dll
- %TEMP%\7zs893fbc91\mydownloader.extension.dll
- %TEMP%\7zs893fbc91\newtonsoft.json.dll
- %TEMP%\7zs893fbc91\pt\devlib.resources.dll
- %TEMP%\7zs893fbc91\ru\devlib.resources.dll
- %TEMP%\7zs893fbc91\sciter32.dll
- %TEMP%\7zs893fbc91\devlib.dll
- %TEMP%\7zs893fbc91\devlib.services.dll
- %TEMP%\7zs893fbc91\installer.exe
- %TEMP%\7zs893fbc91\it\devlib.resources.dll
- %TEMP%\7zs893fbc91\dynactsbll.dll
- %TEMP%\7zs893fbc91\ninject.dll
- %TEMP%\7zs893fbc91\offerservicebll.dll
- %TEMP%\7zs893fbc91\offerservicesdk.dll
- %TEMP%\7zs893fbc91\shared.dll
- %TEMP%\7zs893fbc91\carrier.exe
- %TEMP%\7zs893fbc91\utorrent.dll
- %TEMP%\7zs893fbc91\2022-03-28-20-47-37_installer_pid=1244.txt
- %WINDIR%\temp\cabf47b.tmp
- %TEMP%\7zs893fbc91\h2osciter.dll
- %TEMP%\7zs893fbc91\htmlagilitypack.dll
- %TEMP%\7zs893fbc91\genericsetup.exe
- %TEMP%\7zs893fbc91\genericsetup.dll
- %TEMP%\7zs893fbc91\fr\devlib.resources.dll
- %TEMP%\7zs893fbc91\genericsetup.exe.config
- %TEMP%\7zs893fbc91\resources\finishpage.html
- %TEMP%\7zs893fbc91\resources\images\loader.gif
- %TEMP%\7zs893fbc91\resources\images\warning48x48.png
- %TEMP%\7zs893fbc91\resources\installingpage.html
- %TEMP%\7zs893fbc91\resources\licensepage.html
- %TEMP%\7zs893fbc91\resources\offerpage.html
- %TEMP%\7zs893fbc91\resources\settingpage1.html
- %TEMP%\7zs893fbc91\resources\settingpage2.html
- %TEMP%\7zs893fbc91\bundleconfig.json
- %TEMP%\7zs893fbc91\resources\style.css
- %TEMP%\7zs893fbc91\resources\tis\eventhandler.tis
- %TEMP%\7zs893fbc91\resources\tis\log.tis
- %TEMP%\7zs893fbc91\resources\tis\stubs.tis
- %TEMP%\7zs893fbc91\resources\tis\translateoffertemplate.tis
- %TEMP%\7zs893fbc91\resources\tis\viewstateloader.tis
- %TEMP%\7zs893fbc91\resources\warningpage.html
- %TEMP%\7zs893fbc91\resources\welcomepage.html
- %TEMP%\7zs893fbc91\de\devlib.resources.dll
- %TEMP%\7zs893fbc91\es\devlib.resources.dll
- %TEMP%\7zs893fbc91\resources\tis\config.tis
- %WINDIR%\temp\tarf47c.tmp
- %LOCALAPPDATA%\ut008\genericsetup.exe_url_2idf4nia1h32idoyscwtr00j5ygs0yto\1.0.14.4831\diz2nbcs.newcfg
Deletes the following files
- %WINDIR%\temp\cabf47b.tmp
- %WINDIR%\temp\tarf47c.tmp
Moves the following files
- from %LOCALAPPDATA%\ut008\genericsetup.exe_url_2idf4nia1h32idoyscwtr00j5ygs0yto\1.0.14.4831\diz2nbcs.newcfg to %LOCALAPPDATA%\ut008\genericsetup.exe_url_2idf4nia1h32idoyscwtr00j5ygs0yto\1.0.14.4831\user.config
Network activity
Connects to
- 'localhost':49219
- 'localhost':49221
- 'fl##.#avasoft.com':443
- 'localhost':49227
- 'localhost':49229
- 'so#.#daware.com':443
TCP
Other
- 'localhost':49219
- 'localhost':49221
- 'localhost':49222
- 'fl##.#avasoft.com':443
- 'localhost':49227
- 'localhost':49229
- 'localhost':49230
- 'so#.#daware.com':443
UDP
- DNS ASK fl##.#avasoft.com
- DNS ASK google.com
- DNS ASK so#.#daware.com
- DNS ASK st####.rapidssl.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zs893fbc91\installer.exe'
- '%TEMP%\7zs893fbc91\genericsetup.exe' %TEMP%\7zS893FBC91\GenericSetup.exe hik=c60b7fe3-ad1f-4f43-aba4-ba65e0524080 hmk=427919c3-c65d-cb6b-e63d-0952fb3c70c5 hut=Admin hpp="QzpcaGNwc2t6b2ZcamhnbHZhZGEuZXhl" hts=1648525662017
