Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\televzr\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
- [HKCU\Software\Classes\mkv\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
- [HKCU\Software\Classes\mp4\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
- [HKCU\Software\Classes\avi\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
- [HKCU\Software\Classes\m4v\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
- [HKCU\Software\Classes\televzr\shell\open\command] '' = '"%LOCALAPPDATA%\televzr\Televzr.exe" "%1"'
- [HKCU\Software\Classes\televzr\shell\open\command] '' = ''
Modifies file system
Creates the following files
- %TEMP%\nswa89e.tmp\system.dll
- %APPDATA%\televzr desktop\local storage\leveldb\000001.dbtmp
- %APPDATA%\televzr desktop\code cache\wasm\index
- %APPDATA%\televzr desktop\code cache\js\index
- %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index
- %APPDATA%\televzr desktop\partitions\yt\code cache\js\index
- %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\log
- %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index
- %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\manifest-000001
- %APPDATA%\televzr desktop\partitions\ui\gpucache\index
- %APPDATA%\televzr desktop\partitions\ui\gpucache\data_0
- %APPDATA%\televzr desktop\partitions\ui\gpucache\data_1
- %APPDATA%\televzr desktop\partitions\ui\gpucache\data_2
- %APPDATA%\televzr desktop\partitions\ui\gpucache\data_3
- %APPDATA%\televzr desktop\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\televzr desktop\local storage\leveldb\log
- %APPDATA%\televzr desktop\local storage\leveldb\manifest-000001
- %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\000001.dbtmp
- %APPDATA%\televzr desktop\partitions\ui\code cache\js\index
- %APPDATA%\televzr desktop\partitions\ui\cache\data_0
- %LOCALAPPDATA%\televzr\resources\bin_ia32\yt-dlp.exe
- %LOCALAPPDATA%\televzr\resources\elevate.exe
- %LOCALAPPDATA%\televzr\swiftshader\libegl.dll
- %LOCALAPPDATA%\televzr\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\televzr\televzr.exe
- %APPDATA%\televzr desktop\partitions\ui\cache\index
- %LOCALAPPDATA%\televzr\resources\bin_ia32\ffmpeg.exe
- %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\000001.dbtmp
- %LOCALAPPDATA%\televzr\vk_swiftshader.dll
- %APPDATA%\microsoft\windows\start menu\programs\televzr.lnk
- %TEMP%\nswa89e.tmp\winshell.dll
- %HOMEPATH%\desktop\televzr.lnk
- %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\log
- %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\manifest-000001
- %LOCALAPPDATA%\televzr\vulkan-1.dll
- %LOCALAPPDATA%\televzr-updater\package.7z
- %LOCALAPPDATA%\televzr\uninstall televzr.exe
- %LOCALAPPDATA%\televzr\locales\pl.pak
- %APPDATA%\televzr desktop\partitions\ui\cache\data_1
- %APPDATA%\televzr desktop\partitions\ui\4f9dacdb-a969-4062-b6b4-7c51f3b31499.tmp
- %APPDATA%\televzr desktop\1ed88e71-644f-488e-bb66-7acad339ff2a.tmp
- %APPDATA%\televzr desktop\partitions\yt\23a8919c-5add-4768-b633-c9678bd0de64.tmp
- %APPDATA%\televzr desktop\partitions\ui\556b3989-a0af-4fe5-bffb-2c76da96e785.tmp
- %APPDATA%\televzr desktop\c6e15b89-ddb1-4885-907d-abe2d35983c0.tmp
- %APPDATA%\televzr desktop\partitions\yt\598dd737-403e-4eba-817f-e14f653fe776.tmp
- %APPDATA%\televzr desktop\gpucache\index
- %APPDATA%\televzr desktop\cookies
- %LOCALAPPDATA%\televzr\libglesv2.dll
- %APPDATA%\televzr desktop\cookies-journal
- %APPDATA%\televzr desktop\gpucache\data_3
- %APPDATA%\televzr desktop\logs\televzr-2023-11-28.log
- %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\log
- %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\manifest-000001
- %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp
- %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000003.log
- %APPDATA%\televzr desktop\gpucache\data_1
- %APPDATA%\televzr desktop\gpucache\data_0
- %LOCALAPPDATA%\televzr\resources\bin_ia32\ffprobe.exe
- %APPDATA%\televzr desktop\partitions\yt\cache\data_3
- %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\temp-index
- %APPDATA%\televzr desktop\cache\index
- %APPDATA%\televzr desktop\cache\data_0
- %APPDATA%\televzr desktop\cache\data_1
- %APPDATA%\televzr desktop\cache\data_2
- %APPDATA%\televzr desktop\cache\data_3
- %APPDATA%\televzr desktop\partitions\yt\cache\index
- %APPDATA%\televzr desktop\config.json
- %APPDATA%\televzr desktop\partitions\ui\cache\data_2
- %APPDATA%\televzr desktop\partitions\ui\cache\data_3
- %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\temp-index
- %APPDATA%\televzr desktop\code cache\js\index-dir\temp-index
- %APPDATA%\televzr desktop\code cache\wasm\index-dir\temp-index
- %APPDATA%\televzr desktop\partitions\yt\cache\data_0
- %APPDATA%\televzr desktop\partitions\yt\cache\data_1
- %APPDATA%\televzr desktop\partitions\yt\cache\data_2
- %APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\temp-index
- %APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\televzr\libegl.dll
- %LOCALAPPDATA%\televzr\ffmpeg.dll
- %LOCALAPPDATA%\televzr\d3dcompiler_47.dll
- %LOCALAPPDATA%\televzr\locales\en-gb.pak
- %LOCALAPPDATA%\televzr\locales\en-us.pak
- %LOCALAPPDATA%\televzr\locales\es-419.pak
- %LOCALAPPDATA%\televzr\locales\es.pak
- %LOCALAPPDATA%\televzr\locales\et.pak
- %LOCALAPPDATA%\televzr\locales\da.pak
- %LOCALAPPDATA%\televzr\chrome_100_percent.pak
- %LOCALAPPDATA%\televzr\locales\el.pak
- %LOCALAPPDATA%\televzr\locales\fa.pak
- %LOCALAPPDATA%\televzr\locales\gu.pak
- %LOCALAPPDATA%\televzr\locales\he.pak
- %LOCALAPPDATA%\televzr\locales\hi.pak
- %LOCALAPPDATA%\televzr\locales\hr.pak
- %LOCALAPPDATA%\televzr\locales\hu.pak
- %LOCALAPPDATA%\televzr\locales\fi.pak
- %LOCALAPPDATA%\televzr\locales\fil.pak
- %LOCALAPPDATA%\televzr\locales\fr.pak
- %APPDATA%\televzr desktop\quotamanager-journal
- %LOCALAPPDATA%\televzr\locales\id.pak
- %LOCALAPPDATA%\televzr\locales\bn.pak
- %TEMP%\nswa89e.tmp\nsexec.dll
- %TEMP%\nswa89e.tmp\spiderbanner.dll
- %TEMP%\nswa89e.tmp\nsprocess.dll
- %TEMP%\nswa89e.tmp\inetc.dll
- %LOCALAPPDATA%\televzr\uninstallericon.ico
- %TEMP%\nswa89e.tmp\package.7z
- %LOCALAPPDATA%\televzr\locales\ca.pak
- %LOCALAPPDATA%\televzr\locales\cs.pak
- %TEMP%\nswa89e.tmp\nsis7z.dll
- %LOCALAPPDATA%\televzr\icudtl.dat
- %LOCALAPPDATA%\televzr\license.electron.txt
- %LOCALAPPDATA%\televzr\licenses.chromium.html
- %LOCALAPPDATA%\televzr\locales\am.pak
- %LOCALAPPDATA%\televzr\locales\ar.pak
- %LOCALAPPDATA%\televzr\locales\bg.pak
- %TEMP%\nswa89e.tmp\stdutils.dll
- %LOCALAPPDATA%\televzr\chrome_200_percent.pak
- %APPDATA%\televzr desktop\gpucache\data_2
- %LOCALAPPDATA%\televzr\locales\it.pak
- %LOCALAPPDATA%\televzr\locales\ko.pak
- %LOCALAPPDATA%\televzr\locales\tr.pak
- %LOCALAPPDATA%\televzr\locales\uk.pak
- %LOCALAPPDATA%\televzr\locales\vi.pak
- %LOCALAPPDATA%\televzr\locales\zh-cn.pak
- %LOCALAPPDATA%\televzr\locales\zh-tw.pak
- %LOCALAPPDATA%\televzr\resources.pak
- %LOCALAPPDATA%\televzr\locales\ja.pak
- %LOCALAPPDATA%\televzr\locales\th.pak
- %LOCALAPPDATA%\televzr\locales\te.pak
- %LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
- %LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\af46f86f65f624cfee407eac19d946db.ico
- %LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
- %LOCALAPPDATA%\televzr\snapshot_blob.bin
- %LOCALAPPDATA%\televzr\v8_context_snapshot.bin
- %LOCALAPPDATA%\televzr\vk_swiftshader_icd.json
- %LOCALAPPDATA%\televzr\resources\app-update.yml
- %LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\6111917f3a5c9c62e67df5a0d0e9136e.ico
- %LOCALAPPDATA%\televzr\locales\kn.pak
- %LOCALAPPDATA%\televzr\resources\app.asar
- %LOCALAPPDATA%\televzr\locales\de.pak
- %LOCALAPPDATA%\televzr\locales\lt.pak
- %LOCALAPPDATA%\televzr\locales\lv.pak
- %LOCALAPPDATA%\televzr\locales\ml.pak
- %LOCALAPPDATA%\televzr\locales\mr.pak
- %LOCALAPPDATA%\televzr\locales\ms.pak
- %LOCALAPPDATA%\televzr\locales\nb.pak
- %LOCALAPPDATA%\televzr\locales\sv.pak
- %LOCALAPPDATA%\televzr\locales\ta.pak
- %LOCALAPPDATA%\televzr\locales\sw.pak
- %LOCALAPPDATA%\televzr\locales\pt-pt.pak
- %LOCALAPPDATA%\televzr\locales\ro.pak
- %LOCALAPPDATA%\televzr\locales\ru.pak
- %LOCALAPPDATA%\televzr\locales\sk.pak
- %LOCALAPPDATA%\televzr\locales\sl.pak
- %LOCALAPPDATA%\televzr\locales\sr.pak
- %LOCALAPPDATA%\televzr\locales\nl.pak
- %LOCALAPPDATA%\televzr\locales\pt-br.pak
- %APPDATA%\televzr desktop\quotamanager
Deletes the following files
- %TEMP%\nswa89e.tmp\inetc.dll
- %TEMP%\nswa89e.tmp\nsexec.dll
- %TEMP%\nswa89e.tmp\nsis7z.dll
- %TEMP%\nswa89e.tmp\nsprocess.dll
- %TEMP%\nswa89e.tmp\spiderbanner.dll
- %TEMP%\nswa89e.tmp\stdutils.dll
- %TEMP%\nswa89e.tmp\system.dll
- %TEMP%\nswa89e.tmp\winshell.dll
- %APPDATA%\televzr desktop\preferences~rf112471.tmp
- %APPDATA%\televzr desktop\network persistent state~rf122857.tmp
Moves the following files
- from %TEMP%\nswa89e.tmp\package.7z to %LOCALAPPDATA%\televzr-updater\package.7z
- from %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp to %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\current
- from %APPDATA%\televzr desktop\partitions\yt\598dd737-403e-4eba-817f-e14f653fe776.tmp to %APPDATA%\televzr desktop\partitions\yt\network persistent state
- from %APPDATA%\televzr desktop\c6e15b89-ddb1-4885-907d-abe2d35983c0.tmp to %APPDATA%\televzr desktop\network persistent state
- from %APPDATA%\televzr desktop\partitions\ui\556b3989-a0af-4fe5-bffb-2c76da96e785.tmp to %APPDATA%\televzr desktop\partitions\ui\network persistent state
- from %APPDATA%\televzr desktop\partitions\yt\23a8919c-5add-4768-b633-c9678bd0de64.tmp to %APPDATA%\televzr desktop\partitions\yt\preferences
- from %APPDATA%\televzr desktop\1ed88e71-644f-488e-bb66-7acad339ff2a.tmp to %APPDATA%\televzr desktop\preferences
- from %APPDATA%\televzr desktop\partitions\ui\4f9dacdb-a969-4062-b6b4-7c51f3b31499.tmp to %APPDATA%\televzr desktop\partitions\ui\preferences
- from %APPDATA%\televzr desktop\preferences to %APPDATA%\televzr desktop\preferences~rf112471.tmp
- from %APPDATA%\televzr desktop\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\the-real-index
- from %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\the-real-index
- from %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\current
- from %APPDATA%\televzr desktop\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\local storage\leveldb\current
- from %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\current
- from %APPDATA%\televzr desktop\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\code cache\js\index-dir\the-real-index
- from %APPDATA%\televzr desktop\network persistent state to %APPDATA%\televzr desktop\network persistent state~rf122857.tmp
Network activity
Connects to
- 'go#####a###ytics.com':80
- 'de####p.televzr.com':80
- 'cd###elevzr.com':80
- 're####ctor.gvt1.com':443
TCP
HTTP GET requests
- http://de####p.televzr.com/download/updater/latest/televzr.nsis.7z
- http://cd###elevzr.com/televzr-1.16.5-ia32.nsis.7z
- http://de####p.televzr.com/api/geo
HTTP POST requests
- http://www.go#####a###ytics.com/collect
Other
- 'go#####a###ytics.com':443
UDP
- DNS ASK go#####a###ytics.com
- DNS ASK de####p.televzr.com
- DNS ASK cd###elevzr.com
- DNS ASK re####ctor.gvt1.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Televzr Desktop'
Creates and executes the following
- '%LOCALAPPDATA%\televzr\televzr.exe'
- '%LOCALAPPDATA%\televzr\televzr.exe' --type=gpu-process --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCooki...
- '%LOCALAPPDATA%\televzr\televzr.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,Har...
- '%LOCALAPPDATA%\televzr\televzr.exe' --type=renderer --user-data-dir="%APPDATA%\Televzr Desktop" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --s...
- '%LOCALAPPDATA%\televzr\televzr.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,Hardwar...
- '%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open /ve /t REG_SZ /d "Open with Televzr" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\televzr\Televzr.exe\" \"%1\"" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v vid' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v userid' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Classes\(value not set)\shell\open\command" /ve' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v televzr /t REG_SZ /d "" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v televzr /t REG_SZ /d "" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v televzr /t REG_SZ /d "" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v televzr /t REG_SZ /d "" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open /ve /t REG_SZ /d "Open with Televzr" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\televzr\Televzr.exe\" \"%1\"" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr /f
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v vid
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v userid
- '%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve
- '%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Classes\(value not set)\shell\open\command" /ve
