Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\betternet\shell\open\command] '' = '"%ProgramFiles(x86)%\Betternet\Betternet.exe" --uri "%1"'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\tap0901] 'ImagePath' = 'system32\DRIVERS\tap0901.sys'
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\betternet premium 5.3.0.433.exe
- %ProgramFiles(x86)%\betternet\foundation.common.tracking.dll
- %ProgramFiles(x86)%\betternet\foundation.extensions.dll
- %ProgramFiles(x86)%\betternet\foundation.extproc.hydra.dll
- %ProgramFiles(x86)%\betternet\foundation.interop.memory.dll
- %ProgramFiles(x86)%\betternet\foundation.interop.wfp.dll
- %ProgramFiles(x86)%\betternet\foundation.premium.dll
- %ProgramFiles(x86)%\betternet\foundation.vpn.common.dll
- %ProgramFiles(x86)%\betternet\afvpn.tlb
- %ProgramFiles(x86)%\betternet\foundation.vpn.dll
- %ProgramFiles(x86)%\betternet\foundation.vpn.sdk.dll
- %ProgramFiles(x86)%\betternet\google.protobuf.dll
- %ProgramFiles(x86)%\betternet\x64\hydra.exe
- %ProgramFiles(x86)%\betternet\x86\hydra.exe
- %ProgramFiles(x86)%\betternet\interop.networklist.dll
- %ProgramFiles(x86)%\betternet\foundation.common.rpc.dll
- %ProgramFiles(x86)%\betternet\foundation.common.dll
- %ProgramFiles(x86)%\betternet\commonservicelocator.dll
- %ProgramFiles(x86)%\betternet\betternet.windows.services.dll
- %ProgramFiles(x86)%\betternet\betternet.windows.sdk.dll
- %ProgramFiles(x86)%\betternet\betternet.windows.dialogs.dll
- %ProgramFiles(x86)%\betternet\betternet.exe.config
- %ProgramFiles(x86)%\betternet\betternet.exe
- %ProgramFiles(x86)%\betternet\automapper.dll
- %ProgramFiles(x86)%\betternet\foundation.unifiedapi.dll
- %ProgramFiles(x86)%\betternet\afvpn.manifest
- %ProgramFiles(x86)%\betternet\x86\afvpn.dll
- %ProgramFiles(x86)%\betternet\x64\afvpn.dll
- %ProgramFiles(x86)%\betternet\foundation.nativecrashreport.dll
- %ProgramFiles(x86)%\betternet\foundation.common.networking.dll
- %ProgramFiles(x86)%\betternet\system.threading.tasks.extensions.dll
- %ProgramFiles(x86)%\betternet\system.windows.interactivity.dll
- %ProgramFiles(x86)%\betternet\newtonsoft.json.dll
- %ProgramFiles(x86)%\betternet\nlog.config
- %ProgramFiles(x86)%\betternet\nlog.dll
- %ProgramFiles(x86)%\betternet\polly.dll
- %ProgramFiles%\tap-windows\driver\oemvista.inf
- %ProgramFiles%\tap-windows\driver\tap0901.cat
- %ProgramFiles%\tap-windows\driver\tap0901.sys
- %ProgramFiles%\tap-windows\license.txt
- %ProgramFiles%\tap-windows\icon.ico
- %TEMP%\nsl7bee.tmp\nsexec.dll
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta6d7.tmp
- %ProgramFiles(x86)%\betternet\system.collections.immutable.dll
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta90a.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\temp\udd1c06.tmp
- %ProgramFiles%\tap-windows\uninstall.exe
- %WINDIR%\installer\msi8c6b.tmp-\wixsharp.dll
- %WINDIR%\installer\msi8c6b.tmp-\customaction.config
- %ProgramFiles%\tap-windows\bin\tapinstall.exe
- %ProgramFiles(x86)%\betternet\system.valuetuple.dll
- %TEMP%\nsl7bee.tmp\system.dll
- %ProgramFiles(x86)%\betternet\system.memory.dll
- %ProgramFiles(x86)%\betternet\prism.dll
- %ProgramFiles(x86)%\betternet\prism.unity.wpf.dll
- %ProgramFiles(x86)%\betternet\prism.wpf.dll
- %ProgramFiles(x86)%\betternet\simpleinjector.dll
- %ProgramFiles(x86)%\betternet\stdole.dll
- %ProgramFiles(x86)%\betternet\system.buffers.dll
- %WINDIR%\installer\msi8c6b.tmp-\microsoft.deployment.windowsinstaller.dll
- C:\users\public\desktop\betternet.lnk
- %ProgramFiles(x86)%\betternet\tap-windows-9.21.2.exe
- %ProgramFiles(x86)%\betternet\unity.abstractions.dll
- %ProgramFiles(x86)%\betternet\unity.container.dll
- %WINDIR%\installer\{4c4d0820-8bd9-45bc-9ee7-73e7c4ff99aa}\app_icon.ico
- %WINDIR%\installer\{4c4d0820-8bd9-45bc-9ee7-73e7c4ff99aa}\iconfile1_launcher_icon.ico
- %PROGRAMDATA%\microsoft\windows\start menu\programs\betterne\betternet.lnk
- %TEMP%\nsl7bee.tmp\userinfo.dll
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta59d.tmp
- %ProgramFiles(x86)%\betternet\betternet.windows.infrastructure.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\is-ipn4v.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3t6vo.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-b43rv.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-0k468.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-4ctbv.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-uep3o.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hp12t.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-u2pfc.tmp
- %TEMP%\is-ulole.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-h09rq.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-4c9u7.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3eovi.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-dolgi.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-bg2om.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-ou61m.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-l4gsi.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-rbtbp.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-5ftpl.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-c9qj3.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-vljre.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-t1pto.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-klfg8.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-905l0.tmp
- %TEMP%\is-ulole.tmp\btn\is-d186q.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-h137u.tmp
- %TEMP%\is-ulole.tmp\metroblue.vsf
- %TEMP%\is-ulole.tmp\vclstylesinno.dll
- %TEMP%\is-ulole.tmp\istask.dll
- %TEMP%\is-ulole.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ulole.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ulole.tmp\_isetup\_regdll.tmp
- %TEMP%\is-rsbcj.tmp\betternet premium 5.3.0.433.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-ta3ft.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-r9vt8.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-dd3v6.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-tme52.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hdfdf.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-buvbf.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3l4an.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-befl8.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-doch5.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-1gq0t.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\is-kdh3h.tmp
- %ProgramFiles(x86)%\betternet\system.runtime.compilerservices.unsafe.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\is-b74fl.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\is-vj5cg.tmp
- %ProgramFiles(x86)%\betternet\kaitaistruct.runtime.csharp.dll
- %ProgramFiles(x86)%\betternet\system.runtime.interopservices.runtimeinformation.dll
- %ProgramFiles(x86)%\betternet\hardcodet.wpf.taskbarnotification.dll
- %ProgramFiles(x86)%\betternet\foundation.extproc.hydra.comtypes.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-6452n.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-2beue.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-bk6cd.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3qkvr.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-i9mfn.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-vmj77.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-s0a7v.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-eia42.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-djh9m.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-8v446.tmp
- %ProgramFiles(x86)%\betternet\system.threading.tasks.dataflow.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-096jr.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hvksl.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-gifdu.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-moc7i.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-77snv.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-67pra.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-fs826.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-e2sod.tmp
- %ProgramFiles(x86)%\betternet\betternet.msi
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\oemvista.inf
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.runtime.compilerservices.unsafe.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.memory.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.collections.immutable.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.buffers.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\stdole.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\simpleinjector.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.threading.tasks.dataflow.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.runtime.interopservices.runtimeinformation.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\polly.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\nlog.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\nlog.config
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\newtonsoft.json.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\kaitaistruct.runtime.csharp.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.wpf.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.sdk.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.threading.tasks.extensions.dll
- %TEMP%\is-ulole.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ulole.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ulole.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ulole.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-ulole.tmp\vclstylesinno.dll
- %TEMP%\is-ulole.tmp\metroblue.vsf
- %TEMP%\is-ulole.tmp\istask.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\hydra.exe
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\afvpn.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\hydra.exe
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\afvpn.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\unity.container.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\unity.abstractions.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\tap-windows-9.21.2.exe
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.windows.interactivity.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\interop.networklist.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.unity.wpf.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\hardcodet.wpf.taskbarnotification.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\google.protobuf.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.sdk.dll
- %WINDIR%\installer\msi8c6b.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.exe
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\automapper.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\afvpn.tlb
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\afvpn.manifest
- %TEMP%\is-ulole.tmp\btn\betternet.msi
- %WINDIR%\installer\msi8c6b.tmp-\wixsharp.dll
- %WINDIR%\installer\msi8c6b.tmp-\customaction.config
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.dialogs.dll
- %TEMP%\nsl7bee.tmp\userinfo.dll
- %TEMP%\nsl7bee.tmp\system.dll
- %TEMP%\nsl7bee.tmp\nsexec.dll
- %WINDIR%\temp\udd1c06.tmp
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\tap0901.sys
- %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\tap0901.cat
- %TEMP%\is-rsbcj.tmp\betternet premium 5.3.0.433.tmp
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.valuetuple.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.infrastructure.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\commonservicelocator.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.exe.config
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.common.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.unifiedapi.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.premium.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.nativecrashreport.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.interop.wfp.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.interop.memory.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extproc.hydra.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extproc.hydra.comtypes.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extensions.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.tracking.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.rpc.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.networking.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.dll
- %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.services.dll
- %TEMP%\7zipsfx.000\betternet premium 5.3.0.433.exe
Moves the following files
- from %TEMP%\is-ulole.tmp\btn\is-d186q.tmp to %TEMP%\is-ulole.tmp\btn\betternet.msi
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-8v446.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\nlog.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3qkvr.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\polly.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-2beue.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hvksl.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.unity.wpf.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-gifdu.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\prism.wpf.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-moc7i.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\simpleinjector.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-77snv.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\stdole.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-67pra.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.buffers.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-fs826.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.collections.immutable.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-096jr.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.memory.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-e2sod.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.runtime.compilerservices.unsafe.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hp12t.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.tracking.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-bk6cd.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.runtime.interopservices.runtimeinformation.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-hdfdf.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.threading.tasks.extensions.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-buvbf.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.valuetuple.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3l4an.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.windows.interactivity.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-befl8.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\tap-windows-9.21.2.exe
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-doch5.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\unity.abstractions.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-1gq0t.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\unity.container.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\is-ipn4v.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\afvpn.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\is-kdh3h.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x64\hydra.exe
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\is-b74fl.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\afvpn.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\is-vj5cg.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\x86\hydra.exe
- from %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta59d.tmp to %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\oemvista.inf
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-eia42.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\newtonsoft.json.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-djh9m.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\nlog.config
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-s0a7v.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\kaitaistruct.runtime.csharp.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-vmj77.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\interop.networklist.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-i9mfn.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\hardcodet.wpf.taskbarnotification.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-klfg8.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\afvpn.tlb
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-t1pto.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\automapper.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-vljre.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.exe
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-c9qj3.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.exe.config
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-5ftpl.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.dialogs.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-rbtbp.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.infrastructure.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-l4gsi.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.sdk.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3t6vo.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\betternet.windows.services.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-b43rv.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\commonservicelocator.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-0k468.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-4ctbv.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.networking.dll
- from %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta6d7.tmp to %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\tap0901.cat
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-6452n.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\system.threading.tasks.dataflow.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-uep3o.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.common.rpc.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-u2pfc.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extproc.hydra.comtypes.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-h09rq.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extproc.hydra.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-4c9u7.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.interop.memory.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-3eovi.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.interop.wfp.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-dolgi.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.nativecrashreport.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-bg2om.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.premium.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-ou61m.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.unifiedapi.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-ta3ft.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.common.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-r9vt8.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-dd3v6.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.vpn.sdk.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-tme52.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\google.protobuf.dll
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-905l0.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\afvpn.manifest
- from %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\is-h137u.tmp to %TEMP%\is-ulole.tmp\btn\programfilesfolder\betternet\foundation.extensions.dll
- from %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\seta90a.tmp to %TEMP%\{4e4d807a-7618-0e2b-82f7-46453345d12d}\tap0901.sys
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Digital Signature Not Found'
Creates and executes the following
- '%TEMP%\7zipsfx.000\betternet premium 5.3.0.433.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-rsbcj.tmp\betternet premium 5.3.0.433.tmp' /SL5="$100228,7327088,64512,%TEMP%\7ZipSfx.000\Betternet Premium 5.3.0.433.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles(x86)%\betternet\tap-windows-9.21.2.exe' /S /SELECT_SHORTCUTS=0 /D=%ProgramFiles(x86)%\OpenVPN
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' hwids tap0901
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' hwids tap0901' (with hidden window)
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\is-ULOLE.tmp\BTN\Betternet.msi" /qn ALL_USERS=1 INSTALLDIR="%ProgramFiles(x86)%\Betternet"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI8C6B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1084812 52 WixSharp!WixSharp.ResilientPackage.WixSharp_CreateResilientPackage_Action
- '%WINDIR%\syswow64\regedit.exe' /S "%TEMP%\7ZipSfx.000\settings.reg"
