Gen:Variant.Adware.Kazy.483773 (B) (Emsisoft), Gen:Variant.Adware.Kazy.483773 (AdAware), Trojan.Win32.Swrort.3.FD (Lavasoft MAS)Behaviour: Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 751cae85b43564f9606f5c394a060bef
SHA1: e63477c4d22c2c6ad11bd462b64a6f07c38fa054
SHA256: a02bc9b1cca27085a5f38dfb7f9f273264f12eeaee35737dfe82f0525b806350
SSDeep: 49152:02sOEUiXX32YMl 2dmOvps1CCzHjgCSxW2CEvylKKZXFIiOe qQz:LgX3qRvNyNSM2qXFcB
Size: 2550600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Stunning Apps
Created at: 2015-05-07 22:44:31
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:556
netsh.exe:1436
netsh.exe:2012
net.exe:1480
net1.exe:792
wd.exe:280
proc.exe:616
Updater.exe:1276
cscript.exe:1824
cscript.exe:1816
cscript.exe:516
cscript.exe:852
cscript.exe:1220
updater.exe:1836
updater.exe:260
updater.exe:644
updater.exe:1376
The Trojan injects its code into the following process(es):
pwdg.exe:1264
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:556 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\background.html (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\content_notifications.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\i18n.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\options.js (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox_installer.js (12 bytes)
%Program Files%\Bench\Proxy\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\chrome.manifest (57 bytes)
%Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_bg.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon100.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\invoke_async.js (2 bytes)
%Program Files%\Bench\Updater\updater.exe (1106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\content_proxy.js (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\migrate.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\jquery.min.js (2106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\xhr.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\timer.js (977 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\uninstall.js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvas_bg.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\storage.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\button.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\console.js (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\io.js (976 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\extension_info.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_webrequest.js (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (3483 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\sqlite3.exe (18662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_client.js (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe (2311 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\chrome_windows.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\framework.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon128.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\browser_button.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\md5.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\legacy.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\main_installer.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\installer.js (799 bytes)
%Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
%Program Files%\Bench\Proxy\proc.exe (8428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_settings.js (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (6 bytes)
%Program Files%\Bench\Proxy\pwdg.exe (5404 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\lang.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\notifications.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_common.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\webrequest.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_workaround.js (1 bytes)
%Program Files%\Bench\NmHost\manifest.json (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_browseraction.js (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\ui_base.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotificationStyle.tmpl (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\registry.js (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\gpedit.exe (1231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe (3799 bytes)
%Program Files%\Bench\Proxy\cl.exe (1083 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_gp_update.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\utils.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\browser.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\messaging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvasscript_engine.js (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\framework_api.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (4 bytes)
%Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotification.tmpl (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\backgroundscript_engine.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\common.js (15 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\bootstrap.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon48.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_installer.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\context_menu.js (2 bytes)
%Program Files%\Bench\Wd\wd.exe (2125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu4.tmp (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\message_target.js (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\ie_installer.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\base.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_engine.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian Settings.url (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\clear_cache.js (522 bytes)
%Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_content.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\projectInstaller.js (3 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (0 bytes)
The process proc.exe:616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\proxy.log (3 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\8d3f613ded3421026a6b47abd4042139 (8 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d (1184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3 (52 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\b24f88eb229178ba93accf228dc5b280 (136 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460 (184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994 (56 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409 (88 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\212e90ffa529f5c99c44dc574c6f9a16 (34015 bytes)
The process Updater.exe:1276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\bench-sys.job (328 bytes)
The process updater.exe:1836 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Bench\Updater\products.xml (431 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (0 bytes)
The process updater.exe:260 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (326 bytes)
The process updater.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (328 bytes)
The process updater.exe:1376 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\BenchUpdater\products.xml (505 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (0 bytes)
Registry activity
The process %original file name%.exe:556 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Bench\NmHost]
"(Default)" = "%Program Files%\Bench\NmHost\nmhost.exe"
[HKLM\SOFTWARE\Browser Guardian]
"CDN" = "browserguardian-a.akamaihd.net"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"system_black_list_url" = "http://browserguardian-a.akamaihd.net/protect/block.json"
[HKLM\SOFTWARE\AdvertisingSupport]
"Seen" = "1"
[HKLM\SOFTWARE\Browser Guardian]
"ZoneId" = "585003"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayName" = "Browser Guardian"
[HKLM\SOFTWARE\Bench\BService]
"Path" = "%Program Files%\Bench\BService\1.1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"Publisher" = "Stunning Apps"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Bench\BService\38997]
"(Default)" = ""
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf2.tmp\nsProcess.dll,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Browser Guardian]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian"
"UTCInstallTime" = "1438791266"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Browser Guardian]
"AllowProxy" = "1"
[HKLM\SOFTWARE\AdvertisingSupport]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"
[HKLM\SOFTWARE\Bench\Wd\38997]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKCU\Software\Proxy]
"APP_NAME" = "Browser Guardian"
[HKLM\SOFTWARE\Bench\Updater\38997]
"(Default)" = ""
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"straoi" = "aug 5, 2015"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Proxy]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\AdvertisingSupport]
"Existing" = "1"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"settings_url" = "http://browserguardian.com/settings.php"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Browser Guardian]
"Seen" = "1"
[HKLM\SOFTWARE\Bench\Updater]
"Path" = "%Program Files%\Bench\Updater\updater.exe"
[HKLM\SOFTWARE\Bench\BService]
"Version" = "1.1"
[HKLM\SOFTWARE\Browser Guardian]
"PID" = "99965"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"Format" = "//{domain}/loaders/{pid}/l.js?pid={pid}&systemid={systemid}&ext={ext}&aoi={aoi}&zoneid={zoneid}&crr={crr}&type=p"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian/icon.ico"
[HKLM\SOFTWARE\Bench\NmHost\38997]
"(Default)" = ""
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"PID" = "99965"
"Domain" = "browserguardian-a.akamaihd.net"
[HKCU\Software\Proxy]
"ProxyServer" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKCU\Software\Proxy]
"AutoConfigURL" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"NoModify" = "1"
[HKLM\SOFTWARE]
"38997" = "Browser Guardian"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKCU\Software\Proxy]
"WaitInitialTimeout" = ""
[HKLM\SOFTWARE\Browser Guardian]
"straoi" = "aug 5, 2015"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 0B 7F 3F 4C C0 1E 6A A9 A4 70 19 12 96 58 58"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian"
[HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.bench.nmhost]
"(Default)" = "%Program Files%\Bench\NmHost\manifest.json"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"more_info_url" = "http://browserguardian.com"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"ext" = "Browser Guardian"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\AdvertisingSupport]
"SeenDate" = "1438791266"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"ZoneId" = "585003"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayVersion" = "1.0"
[HKLM\SOFTWARE\Browser Guardian]
"InstallTime" = "1438802066"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"aoi" = "1438802066"
[HKLM\SOFTWARE\Browser Guardian]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"NoRepair" = "1"
[HKLM\SOFTWARE\Browser Guardian]
"SeenDate" = "1438791266"
[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"protect_redirect_url" = "http://browserguardian.com/warning.php?%blocked_url%"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js Browser Guardian-repairJob"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"
"Bench Communicator Watcher" = "%Program Files%\Bench\Proxy\pwdg.exe"
"WD" = "%Program Files%\Bench\Wd\wd.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bench Settings Cleaner" = "%Program Files%\Bench\Proxy\cl.exe"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Browser Guardian]
"Seen"
[HKCU\Software\Proxy]
"ProxySettingsPerUser"
[HKLM\SOFTWARE\AdvertisingSupport]
"Seen"
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wd"
"Browser Guardian-repairJob"
The process netsh.exe:1436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 65 BA 12 ED EC 3E 44 55 75 97 54 4E 37 FA 43"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Bench\Proxy]
"proc.exe" = "%Program Files%\Bench\Proxy\proc.exe:127.0.0.1/255.255.255.255:Enabled:Proxy"
The process netsh.exe:2012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 76 4E 68 1D DB D4 F7 7D 5E E1 BA C5 02 35 91"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Bench\Proxy]
"pwdg.exe" = "%Program Files%\Bench\Proxy\pwdg.exe:127.0.0.1/255.255.255.255:Enabled:Proxy"
The process pwdg.exe:1264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Bench\Proxy]
"proc.exe" = "proc"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Proxy]
"disableChainProxy" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:3128"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C C4 AB 3C CD 78 52 DA E3 67 E4 17 D4 55 17 34"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 03 00 00 00 03 00 00 00 13 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Proxy]
"totalFail" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process net.exe:1480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 D1 A0 55 B5 5C 1A E3 1B 7F 94 25 45 FB C3 FF"
The process net1.exe:792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A CA C3 87 C3 12 41 C5 03 87 57 AD 5C 13 95 D7"
The process wd.exe:280 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 1C 16 28 E7 01 B1 9D E7 5C 42 C1 C9 0B 37 31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process proc.exe:616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 80 48 14 06 16 48 07 15 3A B8 AD F7 04 E3 E9"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Proxy]
"WaitInitialTimeout"
The process Updater.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 58 FA 12 FA 9E EB 4D C8 C7 80 93 46 F3 AA 5D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process cscript.exe:1824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 21 55 1A 1B E0 79 4A 1E 90 E7 75 85 D4 55 BE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Browser Guardian]
"czoneid" = "12199"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process cscript.exe:1816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 1D 94 93 06 FC 31 B1 25 FA 87 E6 AD 27 71 A5"
The process cscript.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 65 AF FA F4 FA 41 4D 9F 6A 97 19 5B 13 DE 6A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process cscript.exe:852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 E5 75 9E 19 12 D7 18 48 7B 8A 21 1D 3E 78 19"
The process cscript.exe:1220 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 24 8B 82 D7 22 28 43 4F 6B 58 A6 C3 E8 3C 6E"
[HKLM\SOFTWARE\Bench\InstalledExtensions]
"38997" = ""
The process updater.exe:1836 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 77 FC C4 B0 8C 56 5C 06 04 47 8F A0 1D 23 B5"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process updater.exe:260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A A2 75 F6 0D 4C 33 4B 92 72 7D C1 2E 4B 85 E1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process updater.exe:644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 E6 2F 95 2F A1 F3 13 2B 54 70 EB A8 D9 D0 90"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process updater.exe:1376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 82 BA 58 C6 24 EC EE 05 83 94 67 1A FA 8C 76"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
Dropped PE files
MD5 | File path |
---|---|
791a36c814a825fdfe596e5e7eea27b7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe |
2796990b18b323edd2446efec850a354 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\gpedit.exe |
82771129b12517cf5c6e2244d14e8360 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\sqlite3.exe |
890dd063a6b3ae1a9256401577a65d74 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\uninstall.exe |
05450face243b3a7472407b999b03a72 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsf2.tmp\nsProcess.dll |
8e4be86a6eb429ec81eda3e027d0d29d | c:\Program Files\Bench\BService\1.1\bhelper.dll |
e52deb34958a6b9c9defd04072ba320c | c:\Program Files\Bench\BService\1.1\bservice.exe |
5820ed0b943181e5c0cd842d73698d60 | c:\Program Files\Bench\NmHost\nmhost.exe |
dde422a874f4c924f7697ac5d53b2181 | c:\Program Files\Bench\Proxy\cl.exe |
a694180da7c9a463b28db094ef503aa7 | c:\Program Files\Bench\Proxy\proc.exe |
18792d4133445af44bd08f505f14efab | c:\Program Files\Bench\Proxy\pwdg.exe |
729975e07ead4a4b14d020c2bb446833 | c:\Program Files\Bench\Updater\1.7.0.0\updater.exe |
27862bc4eb31d1e68b866a9f32c87fd4 | c:\Program Files\Bench\Updater\updater.exe |
0d3f1ae3a351ae8340a03a45f6b93995 | c:\Program Files\Bench\Wd\wd.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:556
netsh.exe:1436
netsh.exe:2012
net.exe:1480
net1.exe:792
wd.exe:280
proc.exe:616
Updater.exe:1276
cscript.exe:1824
cscript.exe:1816
cscript.exe:516
cscript.exe:852
cscript.exe:1220
updater.exe:1836
updater.exe:260
updater.exe:644
updater.exe:1376 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\background.html (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\content_notifications.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\i18n.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\options.js (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox_installer.js (12 bytes)
%Program Files%\Bench\Proxy\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\chrome.manifest (57 bytes)
%Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_bg.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon100.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\invoke_async.js (2 bytes)
%Program Files%\Bench\Updater\updater.exe (1106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\content_proxy.js (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\migrate.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\jquery.min.js (2106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\xhr.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\timer.js (977 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\uninstall.js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvas_bg.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\storage.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\button.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\console.js (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\io.js (976 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\extension_info.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_webrequest.js (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (3483 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\sqlite3.exe (18662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_client.js (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe (2311 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\chrome_windows.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\framework.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon128.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\browser_button.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\md5.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\legacy.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\main_installer.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\installer.js (799 bytes)
%Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
%Program Files%\Bench\Proxy\proc.exe (8428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_settings.js (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (6 bytes)
%Program Files%\Bench\Proxy\pwdg.exe (5404 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\lang.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\notifications.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_common.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\webrequest.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_workaround.js (1 bytes)
%Program Files%\Bench\NmHost\manifest.json (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_browseraction.js (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\ui_base.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotificationStyle.tmpl (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\registry.js (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\gpedit.exe (1231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe (3799 bytes)
%Program Files%\Bench\Proxy\cl.exe (1083 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_gp_update.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\utils.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\browser.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\messaging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvasscript_engine.js (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\framework_api.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (4 bytes)
%Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotification.tmpl (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\backgroundscript_engine.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\common.js (15 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\bootstrap.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon48.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_installer.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\context_menu.js (2 bytes)
%Program Files%\Bench\Wd\wd.exe (2125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu4.tmp (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\message_target.js (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\ie_installer.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\base.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_engine.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian Settings.url (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\clear_cache.js (522 bytes)
%Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_content.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\projectInstaller.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\proxy.log (3 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\8d3f613ded3421026a6b47abd4042139 (8 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d (1184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3 (52 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\b24f88eb229178ba93accf228dc5b280 (136 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460 (184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994 (56 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409 (88 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\212e90ffa529f5c99c44dc574c6f9a16 (34015 bytes)
%WinDir%\Tasks\bench-sys.job (328 bytes)
%Program Files%\Bench\Updater\products.xml (431 bytes)
%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\BenchUpdater\products.xml (505 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js Browser Guardian-repairJob"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bench Communicator Watcher" = "%Program Files%\Bench\Proxy\pwdg.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WD" = "%Program Files%\Bench\Wd\wd.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bench Settings Cleaner" = "%Program Files%\Bench\Proxy\cl.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Stunning Apps
Product Name: Browser Guardian
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)
Company Name: Stunning AppsProduct Name: Browser GuardianProduct Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 24850 | 25088 | 4.45292 | 280b5067e83a2655e41266029de8734b |
.rdata | 32768 | 6298 | 6656 | 3.6991 | 0bca805dbc100fd47a5eef6225278601 |
.data | 40960 | 220348 | 512 | 0.937397 | 76c848d0823243a67ec793e061f2903d |
.ndata | 262144 | 364544 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 626688 | 35136 | 35328 | 3.14964 | ee656d388281e4030b8015ac6ef8a37b |
.reloc | 663552 | 3034 | 3072 | 3.53777 | 59fb7f02065e80f0f836a99fc5f7a407 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://d2rx3wo6u6259k.cloudfront.net/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 | |
hxxp://a402.d.akamai.net/protect/block.json | |
hxxp://d2rx3wo6u6259k.cloudfront.net/tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 | |
hxxp://d2rx3wo6u6259k.cloudfront.net/id-check/4433e0bcf600ea79ca332930e87765a0/ | |
hxxp://d2rx3wo6u6259k.cloudfront.net/newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=1 | |
hxxp://a402.d.akamai.net/check | |
hxxp://a1205.g.akamai.net/check | |
hxxp://www.installping5.info/newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=1 | 54.239.168.92 |
hxxp://browserguardian-a.akamaihd.net/protect/block.json | 194.146.191.107 |
hxxp://www.installping5.info/id-check/4433e0bcf600ea79ca332930e87765a0/ | 54.239.168.92 |
hxxp://www.installping5.info/tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 | 54.239.168.92 |
hxxp://contentcache-a.akamaihd.net/check | 194.146.191.106 |
hxxp://www.installping5.info/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 | 54.239.168.92 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=1 HTTP/1.0
Host: VVV.installping5.info
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: close
Server: nginx/1.8.0
Date: Wed, 05 Aug 2015 16:14:34 GMT
X-Powered-By: PHP/5.3.3
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Wed, 05 Aug 2015 16:14:34 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Cache: Miss from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8F2fUIrY72bbag3_ajx27nryemTQAIKhq_Lkhu0BfGXjmnGd50p5jg==
GET /check HTTP/1.0
Accept: */*
Host: contentcache-a.akamaihd.net
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.0 200 OK
x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN
x-amz-request-id: 03A364489BC8BA6B
Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT
ETag: "2e29635f7002e832ff4ce26f55059e71"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 14
Server: AmazonS3
Date: Wed, 05 Aug 2015 16:15:05 GMT
Connection: keep-alive
{working:true}..
GET /tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 HTTP/1.0
Host: VVV.installping5.info
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: close
Server: nginx/1.8.0
Date: Wed, 05 Aug 2015 16:14:33 GMT
X-Powered-By: PHP/5.3.3
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Wed, 05 Aug 2015 16:14:33 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Cache: Miss from cloudfront
Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Ajzj_ObNBz2lP4yzRh5FO1ERC9s2FTMIssz1-LTSXqYX8FnyUhUHdA==
GET /installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 HTTP/1.0
Host: VVV.installping5.info
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 24
Connection: close
Server: nginx/1.8.0
Date: Wed, 05 Aug 2015 16:14:24 GMT
X-Powered-By: PHP/5.3.3
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Wed, 05 Aug 2015 16:14:24 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
X-Cache: Miss from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -R9XFaIRH2x8savbRel5ORo-Uagx_WNufkH7vFqlhXi_uwYsGkpGOQ==
99965:585003:aug 5, 2015..
GET /check HTTP/1.0
Accept: */*
Host: contentcache-a.akamaihd.net
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.0 200 OK
x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN
x-amz-request-id: 03A364489BC8BA6B
Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT
ETag: "2e29635f7002e832ff4ce26f55059e71"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 14
Server: AmazonS3
Date: Wed, 05 Aug 2015 16:14:35 GMT
Connection: keep-alive
{working:true}..
GET /id-check/4433e0bcf600ea79ca332930e87765a0/ HTTP/1.0
Host: VVV.installping5.info
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1
Connection: close
Server: nginx/1.8.0
Date: Wed, 05 Aug 2015 16:14:34 GMT
X-Powered-By: PHP/5.3.3
X-Cache: Miss from cloudfront
Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: bVXpt1Y9eZpIskZp2w-5RUC7__gGoPt30xAa_hjo2pJZ_sqtqRVm1A==
1..
GET /protect/block.json HTTP/1.1
Accept: */*
Host: browserguardian-a.akamaihd.net
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: OzW5qr4D Z7f/7J7aKAGXL4o8FJnmlaFNV/1G6TxGphhXrDK9pua81vMdSJAb8JfgTaI/0vpRUY=
x-amz-request-id: EF57647E9BD9F61B
Last-Modified: Wed, 05 Aug 2015 00:05:30 GMT
ETag: "31f5cebdd2bafe0a7eaa23de6a7bd245"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 2275141
Server: AmazonS3
Date: Wed, 05 Aug 2015 16:14:33 GMT
Connection: keep-alive
{"bl": ["hXXp://bw1x.grandcamarade.com/free/c/SIGsend;jsessionid=FE0C22C8BB6CB0D9FD5A612F489A0F1D?loginkey=0320fb01c1a9d2b003e0b813bed3785c8f58fc18a760e0edc7d9ec80da5b334e", "hXXp://ereznir.co.il/System/online/order.php?email=", "hXXp://VVV.colescornerimages.com/aj/index2.php?Fmall.googel/mail/=&elo=178a2f0403fd32addd34a7b00a005b34f&emr=1&hl=en<mpl=defalut<mplcatce=2&scc=1&ss=1", "http://ccdnigeria.org/wp-admin/VVV.standardbank.co.za/verify/", "hXXp://eishockey-oldies-straubing.de/tmp/library/default.ahx/", "hXXp://VVV.derrick-tienhsin.com/sobresalir.doc", "hXXp://VVV.deportimperium.com/clinic/clinic/md/private", "hXXp://jerryblevinslaw.com/asp/docss/contactform.php", "hXXp://VVV.phone2support.com/wp-includes/images/shop/9398/", "hXXp://bigbearhouseforrent.com/ogbono/Docs/index.php", "hXXp://granby-industriel.com/Dropbox/dropbox/", "hXXp://boss.timeforband.com/newgoodle(1)natasha/2013gdocs", "hXXp://bramwebinar.com/goodtehd/", "http://VVV.bronzetto.ro/filos/file/index.php?userid=", "hXXp://naylorantiques.com/hotsites/qcl5berm/", "hXXp://movingfurnituresaudi.com/wordpress/share (2)/share/share/2015/index.htm", "hXXp://convivir.org/2014/wp-admin/BCC/7c2b12fdb05f38352042176ba97cbe77", "hXXp://fusionfootballodyssey.com/modules/mod_cblogin/cblogin.html", "hXXp://splitapartman.com/folder/DBB/Dropbox/dropbox/index.php", "hXXp://scarpaci.de/tre/H3G_WEB/home.do//51C8DC89FA0EA9A5258177B240F9D5D267D875FB7EA94E866AB44B69B3569F56CBCA7A26F49737819E8AE9F2796CA68BF6CEE49CD7A4BA36743B6A1D92A8",
<<< skipped >>>
GET /check HTTP/1.0
Accept: */*
Host: contentcache-a.akamaihd.net
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.0 200 OK
x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN
x-amz-request-id: 03A364489BC8BA6B
Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT
ETag: "2e29635f7002e832ff4ce26f55059e71"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 14
Server: AmazonS3
Date: Wed, 05 Aug 2015 16:14:45 GMT
Connection: keep-alive
{working:true}..
GET /check HTTP/1.0
Accept: */*
Host: contentcache-a.akamaihd.net
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.0 200 OK
x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN
x-amz-request-id: 03A364489BC8BA6B
Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT
ETag: "2e29635f7002e832ff4ce26f55059e71"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 14
Server: AmazonS3
Date: Wed, 05 Aug 2015 16:14:55 GMT
Connection: keep-alive
{working:true}..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
bservice.exe_268:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
operator
operator
GetProcessWindowStation
GetProcessWindowStation
bservice.pdb
bservice.pdb
KERNEL32.dll
KERNEL32.dll
SetWindowsHookExW
SetWindowsHookExW
UnhookWindowsHookEx
UnhookWindowsHookEx
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
4 4@4`4|4
4 4@4`4|4
nKERNEL32.DLL
nKERNEL32.DLL
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
bhelper.dll
bhelper.dll
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0
%Program Files%\Bench\BService\1.1\bservice.exe
%Program Files%\Bench\BService\1.1\bservice.exe
wd.exe_280:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
operator
operator
GetProcessWindowStation
GetProcessWindowStation
wd.pdb
wd.pdb
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
combase.dll
combase.dll
Amscoree.dll
Amscoree.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
kernel32.dll
kernel32.dll
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0
\bservice.exe
\bservice.exe
bservice.exe
bservice.exe
\bservice64.exe
\bservice64.exe
bservice64.exe
bservice64.exe
\cservice.exe
\cservice.exe
cservice.exe
cservice.exe
\cservice64.exe
\cservice64.exe
cservice64.exe
cservice64.exe
%Program Files%\Bench\Wd\wd.exe
%Program Files%\Bench\Wd\wd.exe
pwdg.exe_1264:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
operator
operator
GetProcessWindowStation
GetProcessWindowStation
http=
http=
RegOpenKeyTransactedW
RegOpenKeyTransactedW
ProxyWatchdog.pdb
ProxyWatchdog.pdb
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyW
RegOpenKeyW
RegEnumKeyW
RegEnumKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
PSAPI.DLL
PSAPI.DLL
HttpSendRequestW
HttpSendRequestW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
WININET.dll
WININET.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
54686
54686
6 7$7(7,7
6 7$7(7,7
9$9(9,9094989
9$9(9,9094989
:(:/:4:8:<:>
:(:/:4:8:<:>
:&;,;0;4;8;
:&;,;0;4;8;
;'
;'
6 6$6(6,6
6 6$6(6,6
2 2
2 2
nKERNEL32.DLL
nKERNEL32.DLL
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
settings_url
settings_url
more_info_url
more_info_url
https
https
Advapi32.dll
Advapi32.dll
127.0.0.1
127.0.0.1
%s:%d
%s:%d
hXXp://contentcache-a.akamaihd.net/check
hXXp://contentcache-a.akamaihd.net/check
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running
proc.exe
proc.exe
icon.ico
icon.ico
%Program Files%\Bench\Proxy\pwdg.exe
%Program Files%\Bench\Proxy\pwdg.exe
Otherwise click "Dismiss" and {name} will stop protection from malicious websites. Protection will automatically resume when you restart your computer, unless you uninstall {name}.
Otherwise click "Dismiss" and {name} will stop protection from malicious websites. Protection will automatically resume when you restart your computer, unless you uninstall {name}.
proc.exe_616:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
t.PhhiF
t.PhhiF
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
r%f;M
r%f;M
(function(){if (window.top == window.self){function bindReady(c){function a(){b||(b=!0,c())}var b=!1;if(document.addEventListener)document.addEventListener("DOMContentLoaded",function(){a()},!1);else if(document.attachEvent){if(document.documentElement.doScroll&&window==window.top){var d=function(){if(!b&&document.body)try{document.documentElement.doScroll("left"),a()}catch(c){setTimeout(d,0)}};d()}document.attachEvent("onreadystatechange",function(){"complete"===document.readyState&&a()})}window.addEventListener?window.addEventListener("load",a,!1):window.attachEvent&&window.attachEvent("onload",a)};bindReady(function(){{{medicine}}});}})();
(function(){if (window.top == window.self){function bindReady(c){function a(){b||(b=!0,c())}var b=!1;if(document.addEventListener)document.addEventListener("DOMContentLoaded",function(){a()},!1);else if(document.attachEvent){if(document.documentElement.doScroll&&window==window.top){var d=function(){if(!b&&document.body)try{document.documentElement.doScroll("left"),a()}catch(c){setTimeout(d,0)}};d()}document.attachEvent("onreadystatechange",function(){"complete"===document.readyState&&a()})}window.addEventListener?window.addEventListener("load",a,!1):window.attachEvent&&window.attachEvent("onload",a)};bindReady(function(){{{medicine}}});}})();
(function(){var t=document.createElement('script');t.src ='%s'; document.body.appendChild(t);})();
(function(){var t=document.createElement('script');t.src ='%s'; document.body.appendChild(t);})();
%s: %s
%s: %s
HTTP/1.
HTTP/1.
HTTP/1.0 200 Connection established
HTTP/1.0 200 Connection established
HTTP/1.1 502 Bad Gateway
HTTP/1.1 502 Bad Gateway
HTTP/1.1 504 Gateway Timeout
HTTP/1.1 504 Gateway Timeout
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %redirect_url%
Location: %redirect_url%
HTTP/1.0
HTTP/1.0
HTTP/1.1
HTTP/1.1
HTTP/1.1 200
HTTP/1.1 200
HTTP/1.0 200
HTTP/1.0 200
hXXp://
hXXp://
mozilla
mozilla
chrome
chrome
opera
opera
HTTP/1.0 200 OK
HTTP/1.0 200 OK
Content-length: %d
Content-length: %d
%redirect_url%
%redirect_url%
%blocked_url%
%blocked_url%
RegOpenKeyTransactedW
RegOpenKeyTransactedW
http=
http=
operator
operator
GetProcessWindowStation
GetProcessWindowStation
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
proxy.pdb
proxy.pdb
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
HttpQueryInfoW
HttpQueryInfoW
WININET.dll
WININET.dll
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
CryptDestroyKey
CryptDestroyKey
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyW
RegEnumKeyW
RegEnumKeyExW
RegEnumKeyExW
RegOpenKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
UrlEscapeW
UrlEscapeW
SHLWAPI.dll
SHLWAPI.dll
PSAPI.DLL
PSAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
RPCRT4.dll
RPCRT4.dll
GetExtendedTcpTable
GetExtendedTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
.?AVIKeyValueStorage@@
.?AVIKeyValueStorage@@
6074787
6074787
>0?4?8?@?
>0?4?8?@?
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
2 2*20262
2 2*20262
5%6u6W7
5%6u6W7
2-2v2}2
2-2v2}2
4 4$4(4,4044484
4 4$4(4,4044484
6$6(6,606
6$6(6,606
5(5>5]5}5
5(5>5]5}5
7#7'7 7/73777
7#7'7 7/73777
5!5 5?5`5
5!5 5?5`5
34383
34383
=$=,=4=
=$=,=4=
?$?@?`?|?
?$?@?`?|?
kernel32.dll
kernel32.dll
https
https
Server error. Sorry, bro! I don't support batch requests yet. :(
Server error. Sorry, bro! I don't support batch requests yet. :(
db.get
db.get
db.expiration
db.expiration
db.set
db.set
db.remoteset
db.remoteset
db.updateexpiration
db.updateexpiration
db.remove
db.remove
db.keys
db.keys
db.list
db.list
db.clear
db.clear
protect.enabled
protect.enabled
protect.whitelist.add
protect.whitelist.add
protect.whitelist.remove
protect.whitelist.remove
protect.blacklist.add
protect.blacklist.add
protect.blacklist.remove
protect.blacklist.remove
protect.whitelist.list
protect.whitelist.list
protect.blacklist.list
protect.blacklist.list
{7C6A2610-1B02-4086-B5C7-280DAE53B9AD}_keys
{7C6A2610-1B02-4086-B5C7-280DAE53B9AD}_keys
CClientSocket: m_socket = %u, m_dwOwnerPort = %u, m_dwOwnerPid = %u, m_cstrOwnerName = %s
CClientSocket: m_socket = %u, m_dwOwnerPort = %u, m_dwOwnerPid = %u, m_cstrOwnerName = %s
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
chrome.exe
chrome.exe
@%b %d, %Y
@%b %d, %Y
hXXp://cdnapps-a.akamaihd.net/tb/gz.php?keyset_id={FormatedDate}&xml&rev=0&parent_zone={zoneid}&is_date
hXXp://cdnapps-a.akamaihd.net/tb/gz.php?keyset_id={FormatedDate}&xml&rev=0&parent_zone={zoneid}&is_date
settings_url
settings_url
more_info_url
more_info_url
system_black_list_url
system_black_list_url
protect_redirect_url
protect_redirect_url
"%s" %s
"%s" %s
shell32.dll
shell32.dll
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
Cure added at position %d
Cure added at position %d
01234567
01234567
[INFO] %s
[INFO] %s
[LOG] %s
[LOG] %s
[ERROR] %s
[ERROR] %s
[DEBUG] %s
[DEBUG] %s
Advapi32.dll
Advapi32.dll
yxxxxxxxxxxxxxxxx
yxxxxxxxxxxxxxxxx
\proxy.log
\proxy.log
pwdg.exe
pwdg.exe
Closing socket %d to %s, thread %d
Closing socket %d to %s, thread %d
Reusing socket %d
Reusing socket %d
send failed with error: %d
send failed with error: %d
Hit maximum number of requests on %d, socket will be closed
Hit maximum number of requests on %d, socket will be closed
%s, socket=%d, request=%d
%s, socket=%d, request=%d
Can't find a host name for request on %d, request %d
Can't find a host name for request on %d, request %d
No headers loaded on %d, request %d
No headers loaded on %d, request %d
Socket %d closed after %d requests
Socket %d closed after %d requests
WSAStartup failed with error: %d
WSAStartup failed with error: %d
ListenSocket getaddrinfo failed with error: %d
ListenSocket getaddrinfo failed with error: %d
ListenSocket bind failed with error: %d
ListenSocket bind failed with error: %d
ListenSocket listen failed with error: %d
ListenSocket listen failed with error: %d
Listening on %d
Listening on %d
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running
Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running
ListenSocket accept failed with error: %d
ListenSocket accept failed with error: %d
Ws2_32.dll
Ws2_32.dll
combase.dll
combase.dll
Cmscoree.dll
Cmscoree.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
ADVAPI32.DLL
ADVAPI32.DLL
portuguese-brazilian
portuguese-brazilian
USER32.DLL
USER32.DLL
%Program Files%\Bench\Proxy\proc.exe
%Program Files%\Bench\Proxy\proc.exe