Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\c__program files (x86)_common files_~zftzajp.exe
Modifies file system
Creates the following files
- %TEMP%\aut974f.tmp
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\byclickdownloader.exe.config
- %ProgramFiles(x86)%\by click downloader\microsoft.windowsapicodepack.dll
- %ProgramFiles(x86)%\by click downloader\microsoft.windowsapicodepack.shell.dll
- %ProgramFiles(x86)%\by click downloader\naudio.dll
- %ProgramFiles(x86)%\by click downloader\newtonsoft.json.dll
- %ProgramFiles(x86)%\by click downloader\parser.dll
- %ProgramFiles(x86)%\by click downloader\rtmpdump.exe
- %ProgramFiles(x86)%\by click downloader\taglib-sharp.dll
- %ProgramFiles(x86)%\by click downloader\wpfanimatedgif.dll
- %ProgramFiles(x86)%\by click downloader\authenticationmanager.dll
- %ProgramFiles(x86)%\by click downloader\autodetect.dll
- %ProgramFiles(x86)%\by click downloader\configuration.dll
- %ProgramFiles(x86)%\by click downloader\ffmpeg.exe
- C:\users\public\desktop\by click downloader.lnk
- %ProgramFiles(x86)%\by click downloader\gui.dll
- %ProgramFiles(x86)%\by click downloader\history.dll
- %ProgramFiles(x86)%\by click downloader\interop.ituneslib.dll
- %ProgramFiles(x86)%\by click downloader\ionic.zip.dll
- %ProgramFiles(x86)%\by click downloader\byclickdownloader.exe
- %ProgramFiles(x86)%\by click downloader\byclickdownloader.exe.config
- %ProgramFiles(x86)%\by click downloader\updaterv2.exe
- %ProgramFiles(x86)%\by click downloader\sqlite.interop.dll
- %ProgramFiles(x86)%\by click downloader\system.data.sqlite.dll
- %ProgramFiles(x86)%\by click downloader\bouncycastle.crypto.dll
- %WINDIR%\installer\{11c6c9a6-0442-413d-b69a-0f1fe1aa9b54}\icon_1.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\by click downloader.lnk
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\wpfanimatedgif.dll
- %ProgramFiles(x86)%\by click downloader\core.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\taglib-sharp.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\authenticationmanager.dll
- %TEMP%\mz_etilqs_ougttywzrmzdvtf
- %CommonProgramFiles(x86)%\~zftzajp.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\decoder.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\youtube by click.msi
- %TEMP%\msic7a2.tmp
- %TEMP%\msicbf7.tmp
- %TEMP%\msie34b.tmp
- %ALLUSERSPROFILE%\caphyon\advanced installer\{11c6c9a6-0442-413d-b69a-0f1fe1aa9b54}\byclickdownloader-setup.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\byclickdownloader.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\ffmpeg.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\rtmpdump.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\updaterv2.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\autodetect.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\sqlite.interop.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\bouncycastle.crypto.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\configuration.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\core.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\gui.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\history.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\interop.ituneslib.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\ionic.zip.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\microsoft.windowsapicodepack.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\microsoft.windowsapicodepack.shell.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\naudio.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\newtonsoft.json.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\parser.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\system.data.sqlite.dll
- %TEMP%\aut5a41.tmp
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~zftzajp.exe
Deletes the following files
- %TEMP%\aut974f.tmp
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\microsoft.windowsapicodepack.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\microsoft.windowsapicodepack.shell.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\naudio.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\newtonsoft.json.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\parser.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\rtmpdump.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\system.data.sqlite.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\bouncycastle.crypto.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\taglib-sharp.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\updaterv2.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\wpfanimatedgif.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\youtube by click.msi
- %CommonProgramFiles(x86)%\~zftzajp.exe
- %ProgramFiles(x86)%\by click downloader\configuration.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\ionic.zip.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\interop.ituneslib.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\history.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\gui.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\ffmpeg.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\core.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\configuration.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\byclickdownloader.exe.config
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\byclickdownloader.exe
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\sqlite.interop.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\autodetect.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\1aa9b54\authenticationmanager.dll
- %APPDATA%\byclick\by click downloader 2.3.38\install\decoder.dll
- %TEMP%\msie34b.tmp
- <SYSTEM32>\tasks\c__program files (x86)_common files_~zftzajp.exe
- %TEMP%\msicbf7.tmp
- %TEMP%\msic7a2.tmp
- %ProgramFiles(x86)%\by click downloader\updaterv2.exe
- %TEMP%\aut5a41.tmp
Substitutes the following files
- %ProgramFiles(x86)%\by click downloader\configuration.dll
Network activity
Connects to
- '34.##0.144.191':443
- 'fe########alog-cdn.prod.mozaws.net':443
- 'oc##.#ectigo.com':80
- 'download.microsoft.com':80
- 'download.microsoft.com':443
TCP
HTTP GET requests
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEQDNn7zIYP7%2BW1mkSL2tbq4p
- http://download.microsoft.com/download/9/5/A/95A9616B-7A37-4AF6-BC36-D6EA96C8DAAE/dotNetFx40_Full_x86_x64.exe
Other
- '34.##0.144.191':443
- 'download.microsoft.com':443
UDP
- DNS ASK fe########alog-cdn.prod.mozaws.net
- DNS ASK oc##.#ectigo.com
- DNS ASK download.microsoft.com
Miscellaneous
Creates and executes the following
- '%CommonProgramFiles(x86)%\~zftzajp.exe' /quiet /qn /norestart
- '%CommonProgramFiles(x86)%\~zftzajp.exe' /i "%APPDATA%\ByClick\By Click Downloader 2.3.38\install\1AA9B54\YouTube By Click.msi" /quiet /qn /norestart "AI_SETUPEXEPATH=%CommonProgramFiles(x86)%\~zftzajp.exe" "SETUPEXEDIR=%CommonProgram...
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name="By Click Downloader - YaronS Team"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\ByClick\By Click Downloader 2.3.38\install\1AA9B54\YouTube By Click.msi" /quiet /qn /norestart AI_SETUPEXEPATH="%CommonProgramFiles(x86)%\~zftzajp.exe" SETUPEXEDIR="%CommonProgram...
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
- '<SYSTEM32>\searchfilterhost.exe' 0 508 512 520 65536 516
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name="By Click Downloader - YaronS Team"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="By Click Downloader - YaronS Team"
