Application.Generic.1504997_c0cca4781e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

WebProtectorPlus.exe:544
f4.exe:1032
f1.exe:1168
wmic.exe:1536
f5.exe:1432
schtasks.exe:188
schtasks.exe:1368
%original file name%.exe:2040
LiveUpdateWPP.exe:2000
LiveUpdateWPP.exe:240
find.exe:1152

The Application injects its code into the following process(es):

ntvdm.exe:1220

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process WebProtectorPlus.exe:544 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (34 bytes)
%Program Files%\ThinkProtect\SetupComponents.exe (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process f4.exe:1032 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (6 bytes)
%Program Files%\ThinkupWP\LiveUpdateWPP.exe (11656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (4092 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (6 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (0 bytes)

The process f1.exe:1168 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Program Files%\WebProtector\ToolbarData.ini (847 bytes)
%Program Files%\WebProtector\WebProtector.dll (3073 bytes)
%Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (11 bytes)
%Program Files%\WebProtector\hotbtn.ico (1 bytes)
%Program Files%\WebProtector\btn.ico (1 bytes)
%Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsiD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (0 bytes)

The process ntvdm.exe:1220 makes changes in the file system.

The Application creates and/or writes to the following file(s):

C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (10145 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%WinDir%\Temp\scs10.tmp (33880 bytes)
%Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
%System%\wbem\Repository\FS (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\WebProtector (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (848 bytes)
%Program Files%\ThinkProtect (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (1152 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
C:\$Directory (1200 bytes)
%System% (5832 bytes)
%WinDir%\Prefetch\F5.EXE-26097A9F.pf (24 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
%Program Files% (8 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%System%\wbem (864 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (4 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)

The Application deletes the following file(s):

%WinDir%\Temp\scs10.tmp (0 bytes)
%WinDir%\Temp\scs11.tmp (0 bytes)

The process wmic.exe:1536 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Program Files%\ThinkProtect\TempWmicBatchFile.bat (0 bytes)

The process f5.exe:1432 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Program Files%\ThinkProtect\WebProtectorPlus.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (6 bytes)
%Program Files%\ThinkProtect\uninstall.exe (877 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (6 bytes)
%Program Files%\ThinkProtect\uninst.bat (135 bytes)
%Program Files%\ThinkProtect\Setup32.bat (457 bytes)
%Program Files%\ThinkProtect\SetupOld32.bat (429 bytes)
%Program Files%\ThinkProtect\SetupVista64.bat (458 bytes)
%Program Files%\ThinkProtect\SetupOld64.bat (438 bytes)
%Program Files%\ThinkProtect\SetupVista32.bat (449 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Program Files%\ThinkProtect\Setup64.bat (466 bytes)
%Program Files%\ThinkProtect\verdata (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshA.tmp (12336 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss9.tmp (0 bytes)

The process %original file name%.exe:2040 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (46772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (37172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (3796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (33956 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (0 bytes)

Registry activity

The process WebProtectorPlus.exe:544 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\ThinkProtect]
"SetupComponents.exe" = "SetupComponents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1448180088"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 D5 1D FA F8 E0 64 1F D1 9A 72 7B A5 59 1B 1D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process f4.exe:1032 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED EA 45 69 EC EE 6B 7D 14 63 A0 5B 75 E8 20 2A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{FF97EE74-8F16-4759-8B78-B60FC634A2F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"last" = "0"
"IDIR" = "%Program Files%\ThinkupWP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"
"Src" = "9804"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"
"UninstallString" = "%Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe"

The process f1.exe:1168 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files%\WebProtector\btn.ico"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "WebProtect IE"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKLM\SOFTWARE\WebProtector]
"Path" = "%Program Files%\WebProtector"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\WebProtector"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"URLInfoAbout" = "http://web-protector.net"
"DisplayIcon" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"
"Publisher" = "WebProtector"
"UninstallString" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files%\WebProtector\hotbtn.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "4.2.0.2645"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 06 33 AB 14 1C 2C 6C 3E 6E DC 2D B8 12 52 ED"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process wmic.exe:1536 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 9F 39 C1 5F DE C9 4A 46 18 7A B7 9A A5 D8 04"

The process f5.exe:1432 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"UninstallString" = "%Program Files%\ThinkProtect\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 B7 72 6F F3 57 B7 4B D7 7D 45 B4 E2 07 9F 57"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files%\ThinkProtect"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Protector Plus Agent" = "%Program Files%\ThinkProtect\WebProtectorPlus.exe"

The process schtasks.exe:188 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 F8 B2 1A 49 0A FC 4E D3 7F 51 2F 36 3D 51 B9"

The process schtasks.exe:1368 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 D3 E1 3F 1A DD 77 AE E2 CD 04 E5 A6 AC F0 1C"

The process %original file name%.exe:2040 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 96 83 AF F1 BE CE 9D 05 AF 54 C3 18 78 C0 AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse2.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgwNA=="

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "8C744716-9E7E-4880-A3EC-ECC3A28DDE2A"

The process LiveUpdateWPP.exe:2000 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 F2 82 BE BE C9 28 91 C9 BE 23 A0 21 AC A2 76"

The process LiveUpdateWPP.exe:240 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 19 64 2E F3 FA 89 F6 A2 8A DE 83 85 9E 25 C3"

The process find.exe:1152 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 B5 25 06 2D 0E 7A 9D 9A 2A 8D A9 1D 72 A3 4F"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   WebProtectorPlus.exe:544
   f4.exe:1032
   f1.exe:1168
   wmic.exe:1536
   f5.exe:1432
   schtasks.exe:188
   schtasks.exe:1368
   %original file name%.exe:2040
   LiveUpdateWPP.exe:2000
   LiveUpdateWPP.exe:240
   find.exe:1152

2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (34 bytes)
   %Program Files%\ThinkProtect\SetupComponents.exe (177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (6 bytes)
   %Program Files%\ThinkupWP\LiveUpdateWPP.exe (11656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (4092 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (6 bytes)
   %Program Files%\WebProtector\ToolbarData.ini (847 bytes)
   %Program Files%\WebProtector\WebProtector.dll (3073 bytes)
   %Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (11 bytes)
   %Program Files%\WebProtector\hotbtn.ico (1 bytes)
   %Program Files%\WebProtector\btn.ico (1 bytes)
   %Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
   %WinDir%\Temp\scs11.tmp (10145 bytes)
   %Documents and Settings%\%current user%\FAVORITES (4 bytes)
   %WinDir%\Temp\scs10.tmp (33880 bytes)
   %Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
   %Program Files%\Internet Explorer (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
   %System%\wbem\Repository\FS (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (848 bytes)
   %Documents and Settings%\All Users\Documents\My Music (4 bytes)
   C:\$Directory (1200 bytes)
   %WinDir%\Prefetch\F5.EXE-26097A9F.pf (24 bytes)
   %WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
   %WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
   %Documents and Settings%\%current user%\My Documents (4 bytes)
   %Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
   %System%\config (8 bytes)
   %Documents and Settings%\All Users\Start Menu (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
   %WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
   %Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
   %Program Files%\ThinkProtect\TempWmicBatchFile.bat (0 bytes)
   %Program Files%\ThinkProtect\WebProtectorPlus.exe (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (6 bytes)
   %Program Files%\ThinkProtect\uninstall.exe (877 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (6 bytes)
   %Program Files%\ThinkProtect\uninst.bat (135 bytes)
   %Program Files%\ThinkProtect\Setup32.bat (457 bytes)
   %Program Files%\ThinkProtect\SetupOld32.bat (429 bytes)
   %Program Files%\ThinkProtect\SetupVista64.bat (458 bytes)
   %Program Files%\ThinkProtect\SetupOld64.bat (438 bytes)
   %Program Files%\ThinkProtect\SetupVista32.bat (449 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
   %Program Files%\ThinkProtect\Setup64.bat (466 bytes)
   %Program Files%\ThinkProtect\verdata (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nshA.tmp (12336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (46772 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (37172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (3796 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (33956 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Web Protector Plus Agent" = "%Program Files%\ThinkProtect\WebProtectorPlus.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name: wprotectplus4.2.0.2179in
Product Name: pwprotectplus4.2.0.2179inp
Product Version: 4.2.0.2179
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.2.0.2179
File Description:
Comments:
Language: English (United States)

Company Name: wprotectplus4.2.0.2179inProduct Name: pwprotectplus4.2.0.2179inpProduct Version: 4.2.0.2179Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 4.2.0.2179File Description: Comments: Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /pin.gif?e=start&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: stat.webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:17 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:17 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;....

GET /pin.gif?e=installer&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: stat.webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:38 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:38 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;..

GET /pin.gif?e=tracking&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: stat.webprotectionfree.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:38 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:38 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;..

GET /node/?s=9804&br=4 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:17 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/LiveUpdateWPP_is.exe

0......

GET /c/LiveUpdateWPP_is.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:17 GMT

Content-Type: application/octet-stream

Content-Length: 365343

Last-Modified: Tue, 21 Jul 2015 11:42:33 GMT

Connection: keep-alive

ETag: "55ae3029-5931f"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t..........8............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc...8............z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /node/?s=9804&br=5 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/SetupWPP.exe

0......

GET /c/SetupWPP.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:34 GMT

Content-Type: application/octet-stream

Content-Length: 257237

Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT

Connection: keep-alive

ETag: "54e9a18a-3ecd5"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s..........(............................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...(............v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /node/?s=9804&br=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:35 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_installer.exe

0......

GET /c/webprotector_installer.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionpro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:35 GMT

Content-Type: application/octet-stream

Content-Length: 288291

Last-Modified: Wed, 14 Oct 2015 14:06:25 GMT

Connection: keep-alive

ETag: "561e6161-46623"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....n3T.................\...........0.......p....@.......................................@..................................s...........C...........................................................................p...............................text...|Z.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata...@...@...........................rsrc....C.......D...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /c/SetupComponents.exe HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: webprotectionfree.com

Cache-Control: no-cache

HTTP/1.1 403 Forbidden

Server: nginx/1.4.6 (Ubuntu)

Date: Sun, 22 Nov 2015 08:14:38 GMT

Content-Type: text/html

Content-Length: 177

Connection: keep-ali

Map

The Application connects to the servers at the folowing location(s):

Strings from Dumps

LiveUpdateWPP.exe_240:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

%b %d %H : %M : %S %Y

%b %d %H : %M : %S %Y

%m / %d / %y

%m / %d / %y

%I : %M : %S %p

%I : %M : %S %p

%d / %m / %y

%d / %m / %y

0123456789-

0123456789-

GetProcessWindowStation

GetProcessWindowStation

operator

operator

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb

C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb

WTSAPI32.dll

WTSAPI32.dll

USERENV.dll

USERENV.dll

WinHttpReceiveResponse

WinHttpReceiveResponse

WinHttpSetOption

WinHttpSetOption

WinHttpSendRequest

WinHttpSendRequest

WinHttpConnect

WinHttpConnect

WinHttpCloseHandle

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpen

WinHttpOpenRequest

WinHttpOpenRequest

WinHttpCrackUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpReadData

WINHTTP.dll

WINHTTP.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

ReportEventW

ReportEventW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

zcÁ

zcÁ

.?AVARegKey@@

.?AVARegKey@@

.?AVASysWriteKey@@

.?AVASysWriteKey@@

.?AVASysRegKey@@

.?AVASysRegKey@@

11

11

3O5X5

3O5X5

:%:):/:3:(?

:%:):/:3:(?

1 1$1(1,1014181

1 1$1(1,1014181

: :@:\:`:

: :@:\:`:

? ?$?(?,?0?4?`?

? ?$?(?,?0?4?`?

Ckernel32.dll

Ckernel32.dll

Emscoree.dll

Emscoree.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}

urls

urls

Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.

Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.

AgentTask::Execute :

AgentTask::Execute :

MainTask::Execute

MainTask::Execute

Software\Mozilla\Mozilla Firefox

Software\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__

Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Clients\Windows\StartMenuInternet

Software\Clients\Windows\StartMenuInternet

http\shell\open\command

http\shell\open\command

firefox

firefox

Firefox/

Firefox/

chrome

chrome

Chrome/

Chrome/

opera

opera

OPERA

OPERA

Windows NT

Windows NT

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

ul_cmd

ul_cmd

%s : %s

%s : %s

2.1.1.22

2.1.1.22

%Program Files%\ThinkupWP\LiveUpdateWPP.exe

%Program Files%\ThinkupWP\LiveUpdateWPP.exe

Maintains your Web Protector Plus synchronized.

Maintains your Web Protector Plus synchronized.

LiveUpdateWPP.exe

LiveUpdateWPP.exe

WebProtectorPlus.exe_544:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

vSSSh

vSSSh

FTPjK

FTPjK

FtPj;

FtPj;

C.PjRV

C.PjRV

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

portuguese-brazilian

portuguese-brazilian

operator

operator

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL