Skip to main content

Gen.Variant.Adware.Kazy.483773_751cae85b4


Gen:Variant.Adware.Kazy.483773 (B) (Emsisoft), Gen:Variant.Adware.Kazy.483773 (AdAware), Trojan.Win32.Swrort.3.FD (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 751cae85b43564f9606f5c394a060bef

SHA1: e63477c4d22c2c6ad11bd462b64a6f07c38fa054

SHA256: a02bc9b1cca27085a5f38dfb7f9f273264f12eeaee35737dfe82f0525b806350

SSDeep: 49152:02sOEUiXX32YMl 2dmOvps1CCzHjgCSxW2CEvylKKZXFIiOe qQz:LgX3qRvNyNSM2qXFcB

Size: 2550600 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Stunning Apps

Created at: 2015-05-07 22:44:31

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:556
netsh.exe:1436
netsh.exe:2012
net.exe:1480
net1.exe:792
wd.exe:280
proc.exe:616
Updater.exe:1276
cscript.exe:1824
cscript.exe:1816
cscript.exe:516
cscript.exe:852
cscript.exe:1220
updater.exe:1836
updater.exe:260
updater.exe:644
updater.exe:1376

The Trojan injects its code into the following process(es):

pwdg.exe:1264

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:556 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\background.html (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\content_notifications.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\i18n.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\options.js (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox_installer.js (12 bytes)
%Program Files%\Bench\Proxy\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (359 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\chrome.manifest (57 bytes)
%Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_bg.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon100.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\invoke_async.js (2 bytes)
%Program Files%\Bench\Updater\updater.exe (1106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\content_proxy.js (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\migrate.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\jquery.min.js (2106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\xhr.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\timer.js (977 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\uninstall.js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\icon.ico (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvas_bg.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\storage.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\button.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\console.js (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\io.js (976 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\extension_info.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_webrequest.js (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (3483 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\sqlite3.exe (18662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_client.js (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe (2311 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\chrome_windows.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\framework.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon128.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\browser_button.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\md5.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\legacy.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\main_installer.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\installer.js (799 bytes)
%Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
%Program Files%\Bench\Proxy\proc.exe (8428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_settings.js (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (6 bytes)
%Program Files%\Bench\Proxy\pwdg.exe (5404 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\lang.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\notifications.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_common.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\webrequest.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_workaround.js (1 bytes)
%Program Files%\Bench\NmHost\manifest.json (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_browseraction.js (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\ui_base.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotificationStyle.tmpl (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\registry.js (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\gpedit.exe (1231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe (3799 bytes)
%Program Files%\Bench\Proxy\cl.exe (1083 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_gp_update.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\utils.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\browser.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\messaging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvasscript_engine.js (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\framework_api.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (4 bytes)
%Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotification.tmpl (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\backgroundscript_engine.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\common.js (15 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\bootstrap.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon48.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_installer.js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\context_menu.js (2 bytes)
%Program Files%\Bench\Wd\wd.exe (2125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu4.tmp (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\message_target.js (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\ie_installer.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\base.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_engine.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian Settings.url (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\clear_cache.js (522 bytes)
%Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_content.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\projectInstaller.js (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (0 bytes)

The process proc.exe:616 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\proxy.log (3 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\8d3f613ded3421026a6b47abd4042139 (8 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d (1184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3 (52 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\b24f88eb229178ba93accf228dc5b280 (136 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460 (184 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994 (56 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409 (88 bytes)
%Documents and Settings%\%current user%\Application Data\Protect\Blocker\212e90ffa529f5c99c44dc574c6f9a16 (34015 bytes)

The process Updater.exe:1276 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\bench-sys.job (328 bytes)

The process updater.exe:1836 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\Bench\Updater\products.xml (431 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (0 bytes)

The process updater.exe:260 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (326 bytes)

The process updater.exe:644 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (328 bytes)

The process updater.exe:1376 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\BenchUpdater\products.xml (505 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (0 bytes)

Registry activity

The process %original file name%.exe:556 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Bench\NmHost]
"(Default)" = "%Program Files%\Bench\NmHost\nmhost.exe"

[HKLM\SOFTWARE\Browser Guardian]
"CDN" = "browserguardian-a.akamaihd.net"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"system_black_list_url" = "http://browserguardian-a.akamaihd.net/protect/block.json"

[HKLM\SOFTWARE\AdvertisingSupport]
"Seen" = "1"

[HKLM\SOFTWARE\Browser Guardian]
"ZoneId" = "585003"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayName" = "Browser Guardian"

[HKLM\SOFTWARE\Bench\BService]
"Path" = "%Program Files%\Bench\BService\1.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"Publisher" = "Stunning Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Bench\BService\38997]
"(Default)" = ""

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf2.tmp\nsProcess.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Browser Guardian]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian"
"UTCInstallTime" = "1438791266"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Browser Guardian]
"AllowProxy" = "1"

[HKLM\SOFTWARE\AdvertisingSupport]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"

[HKLM\SOFTWARE\Bench\Wd\38997]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Proxy]
"APP_NAME" = "Browser Guardian"

[HKLM\SOFTWARE\Bench\Updater\38997]
"(Default)" = ""

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"straoi" = "aug 5, 2015"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Proxy]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\AdvertisingSupport]
"Existing" = "1"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"settings_url" = "http://browserguardian.com/settings.php"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Browser Guardian]
"Seen" = "1"

[HKLM\SOFTWARE\Bench\Updater]
"Path" = "%Program Files%\Bench\Updater\updater.exe"

[HKLM\SOFTWARE\Bench\BService]
"Version" = "1.1"

[HKLM\SOFTWARE\Browser Guardian]
"PID" = "99965"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"Format" = "//{domain}/loaders/{pid}/l.js?pid={pid}&systemid={systemid}&ext={ext}&aoi={aoi}&zoneid={zoneid}&crr={crr}&type=p"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian/icon.ico"

[HKLM\SOFTWARE\Bench\NmHost\38997]
"(Default)" = ""

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"PID" = "99965"
"Domain" = "browserguardian-a.akamaihd.net"

[HKCU\Software\Proxy]
"ProxyServer" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Proxy]
"AutoConfigURL" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"NoModify" = "1"

[HKLM\SOFTWARE]
"38997" = "Browser Guardian"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Proxy]
"WaitInitialTimeout" = ""

[HKLM\SOFTWARE\Browser Guardian]
"straoi" = "aug 5, 2015"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 0B 7F 3F 4C C0 1E 6A A9 A4 70 19 12 96 58 58"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian"

[HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.bench.nmhost]
"(Default)" = "%Program Files%\Bench\NmHost\manifest.json"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"more_info_url" = "http://browserguardian.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"ext" = "Browser Guardian"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\AdvertisingSupport]
"SeenDate" = "1438791266"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"ZoneId" = "585003"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"DisplayVersion" = "1.0"

[HKLM\SOFTWARE\Browser Guardian]
"InstallTime" = "1438802066"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"aoi" = "1438802066"

[HKLM\SOFTWARE\Browser Guardian]
"SystemId" = "4433e0bcf600ea79ca332930e87765a0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\38997_Browser Guardian]
"NoRepair" = "1"

[HKLM\SOFTWARE\Browser Guardian]
"SeenDate" = "1438791266"

[HKLM\SOFTWARE\Proxy\Installations\Browser Guardian]
"protect_redirect_url" = "http://browserguardian.com/warning.php?%blocked_url%"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js Browser Guardian-repairJob"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"

"Bench Communicator Watcher" = "%Program Files%\Bench\Proxy\pwdg.exe"

"WD" = "%Program Files%\Bench\Wd\wd.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Browser Guardian" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bench Settings Cleaner" = "%Program Files%\Bench\Proxy\cl.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Browser Guardian]
"Seen"

[HKCU\Software\Proxy]
"ProxySettingsPerUser"

[HKLM\SOFTWARE\AdvertisingSupport]
"Seen"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wd"

"Browser Guardian-repairJob"

The process netsh.exe:1436 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 65 BA 12 ED EC 3E 44 55 75 97 54 4E 37 FA 43"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Bench\Proxy]
"proc.exe" = "%Program Files%\Bench\Proxy\proc.exe:127.0.0.1/255.255.255.255:Enabled:Proxy"

The process netsh.exe:2012 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 76 4E 68 1D DB D4 F7 7D 5E E1 BA C5 02 35 91"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Bench\Proxy]
"pwdg.exe" = "%Program Files%\Bench\Proxy\pwdg.exe:127.0.0.1/255.255.255.255:Enabled:Proxy"

The process pwdg.exe:1264 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Bench\Proxy]
"proc.exe" = "proc"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Proxy]
"disableChainProxy" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:3128"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C C4 AB 3C CD 78 52 DA E3 67 E4 17 D4 55 17 34"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 03 00 00 00 03 00 00 00 13 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Proxy]
"totalFail" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process net.exe:1480 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 D1 A0 55 B5 5C 1A E3 1B 7F 94 25 45 FB C3 FF"

The process net1.exe:792 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A CA C3 87 C3 12 41 C5 03 87 57 AD 5C 13 95 D7"

The process wd.exe:280 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 1C 16 28 E7 01 B1 9D E7 5C 42 C1 C9 0B 37 31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process proc.exe:616 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 80 48 14 06 16 48 07 15 3A B8 AD F7 04 E3 E9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Proxy]
"WaitInitialTimeout"

The process Updater.exe:1276 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 58 FA 12 FA 9E EB 4D C8 C7 80 93 46 F3 AA 5D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process cscript.exe:1824 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 21 55 1A 1B E0 79 4A 1E 90 E7 75 85 D4 55 BE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Browser Guardian]
"czoneid" = "12199"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cscript.exe:1816 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 1D 94 93 06 FC 31 B1 25 FA 87 E6 AD 27 71 A5"

The process cscript.exe:516 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 65 AF FA F4 FA 41 4D 9F 6A 97 19 5B 13 DE 6A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cscript.exe:852 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 E5 75 9E 19 12 D7 18 48 7B 8A 21 1D 3E 78 19"

The process cscript.exe:1220 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 24 8B 82 D7 22 28 43 4F 6B 58 A6 C3 E8 3C 6E"

[HKLM\SOFTWARE\Bench\InstalledExtensions]
"38997" = ""

The process updater.exe:1836 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 77 FC C4 B0 8C 56 5C 06 04 47 8F A0 1D 23 B5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process updater.exe:260 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A A2 75 F6 0D 4C 33 4B 92 72 7D C1 2E 4B 85 E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process updater.exe:644 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 E6 2F 95 2F A1 F3 13 2B 54 70 EB A8 D9 D0 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process updater.exe:1376 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 82 BA 58 C6 24 EC EE 05 83 94 67 1A FA 8C 76"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

MD5 File path
791a36c814a825fdfe596e5e7eea27b7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe
2796990b18b323edd2446efec850a354c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\gpedit.exe
82771129b12517cf5c6e2244d14e8360c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\sqlite3.exe
890dd063a6b3ae1a9256401577a65d74c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Browser Guardian\uninstall.exe
05450face243b3a7472407b999b03a72c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsf2.tmp\nsProcess.dll
8e4be86a6eb429ec81eda3e027d0d29dc:\Program Files\Bench\BService\1.1\bhelper.dll
e52deb34958a6b9c9defd04072ba320cc:\Program Files\Bench\BService\1.1\bservice.exe
5820ed0b943181e5c0cd842d73698d60c:\Program Files\Bench\NmHost\nmhost.exe
dde422a874f4c924f7697ac5d53b2181c:\Program Files\Bench\Proxy\cl.exe
a694180da7c9a463b28db094ef503aa7c:\Program Files\Bench\Proxy\proc.exe
18792d4133445af44bd08f505f14efabc:\Program Files\Bench\Proxy\pwdg.exe
729975e07ead4a4b14d020c2bb446833c:\Program Files\Bench\Updater\1.7.0.0\updater.exe
27862bc4eb31d1e68b866a9f32c87fd4c:\Program Files\Bench\Updater\updater.exe
0d3f1ae3a351ae8340a03a45f6b93995c:\Program Files\Bench\Wd\wd.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:556
    netsh.exe:1436
    netsh.exe:2012
    net.exe:1480
    net1.exe:792
    wd.exe:280
    proc.exe:616
    Updater.exe:1276
    cscript.exe:1824
    cscript.exe:1816
    cscript.exe:516
    cscript.exe:852
    cscript.exe:1220
    updater.exe:1836
    updater.exe:260
    updater.exe:644
    updater.exe:1376

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\background.html (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\content_notifications.js (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\i18n.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\options.js (934 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsC.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox_installer.js (12 bytes)
    %Program Files%\Bench\Proxy\icon.ico (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\info.xml (359 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\chrome.manifest (57 bytes)
    %Program Files%\Bench\BService\1.1\bservice.exe (480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_bg.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon100.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu5.tmp (593 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\invoke_async.js (2 bytes)
    %Program Files%\Bench\Updater\updater.exe (1106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\content_proxy.js (502 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\migrate.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\jquery.min.js (2106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\xhr.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\timer.js (977 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\uninstall.js (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\icon.ico (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvas_bg.js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\storage.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\button.png (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\console.js (540 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\io.js (976 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\extension_info.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_webrequest.js (138 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsDownloadCv.dll (3483 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\sqlite3.exe (18662 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_client.js (310 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\uninstall.exe (2311 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns3.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\chrome_windows.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\framework.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon128.png (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\browser_button.js (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\md5.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\legacy.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\main_installer.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\installer.js (799 bytes)
    %Program Files%\Bench\BService\1.1\bhelper.dll (2719 bytes)
    %Program Files%\Bench\Proxy\proc.exe (8428 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\install.rdf (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_settings.js (83 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns8.tmp (6 bytes)
    %Program Files%\Bench\Proxy\pwdg.exe (5404 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\lang.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\notifications.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon32.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_common.js (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\webrequest.js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_workaround.js (1 bytes)
    %Program Files%\Bench\NmHost\manifest.json (117 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_browseraction.js (799 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsA.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\ui_base.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\get.dat (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotificationStyle.tmpl (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\registry.js (796 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\gpedit.exe (1231 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\SoftwareDetector.exe (3799 bytes)
    %Program Files%\Bench\Proxy\cl.exe (1083 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_gp_update.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\utils.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\browser.js (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\messaging.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\CanvasFramework\canvasscript_engine.js (437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\framework_api.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsB.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\nsProcess.dll (4 bytes)
    %Program Files%\Bench\NmHost\nmhost.exe (4497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\contentNotification.tmpl (836 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns9.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\backgroundscript_engine.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\common.js (15 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Uninstall.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\bootstrap.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\icons\icon48.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\chrome_installer.js (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns6.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework-ui\context_menu.js (2 bytes)
    %Program Files%\Bench\Wd\wd.exe (2125 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu4.tmp (274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\md5dll.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\message_target.js (854 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\ie_installer.js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\base.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ns7.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\framework\userscript_engine.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\pz_info (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Browser Guardian\Browser Guardian Settings.url (187 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\clear_cache.js (522 bytes)
    %Program Files%\Bench\Updater\1.7.0.0\updater.exe (10379 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\firefox\AppFramework\appAPI_content.js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\projectInstaller.js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\proxy.log (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\Blocker\8d3f613ded3421026a6b47abd4042139 (8 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d (1184 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3 (52 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\Blocker\b24f88eb229178ba93accf228dc5b280 (136 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460 (184 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994 (56 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409 (88 bytes)
    %Documents and Settings%\%current user%\Application Data\Protect\Blocker\212e90ffa529f5c99c44dc574c6f9a16 (34015 bytes)
    %WinDir%\Tasks\bench-sys.job (328 bytes)
    %Program Files%\Bench\Updater\products.xml (431 bytes)
    %WinDir%\Tasks\bench-S-1-5-21-1844237615-1960408961-1801674531-1003.job (326 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\BenchUpdater\products.xml (505 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Browser Guardian-repairJob" = "wscript.exe %Documents and Settings%\%current user%\Local Settings\Application Data\Browser Guardian\repair.js Browser Guardian-repairJob"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BService" = "%Program Files%\Bench\BService\1.1\bservice.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Bench Communicator Watcher" = "%Program Files%\Bench\Proxy\pwdg.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WD" = "%Program Files%\Bench\Wd\wd.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Browser Guardian" = ""

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Bench Settings Cleaner" = "%Program Files%\Bench\Proxy\cl.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Stunning Apps
Product Name: Browser Guardian
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Stunning AppsProduct Name: Browser GuardianProduct Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409624850250884.45292280b5067e83a2655e41266029de8734b
.rdata32768629866563.69910bca805dbc100fd47a5eef6225278601
.data409602203485120.93739776c848d0823243a67ec793e061f2903d
.ndata26214436454400d41d8cd98f00b204e9800998ecf8427e
.rsrc62668835136353283.14964ee656d388281e4030b8015ac6ef8a37b
.reloc663552303430723.5377759fb7f02065e80f0f836a99fc5f7a407

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://d2rx3wo6u6259k.cloudfront.net/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965
hxxp://a402.d.akamai.net/protect/block.json
hxxp://d2rx3wo6u6259k.cloudfront.net/tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965
hxxp://d2rx3wo6u6259k.cloudfront.net/id-check/4433e0bcf600ea79ca332930e87765a0/
hxxp://d2rx3wo6u6259k.cloudfront.net/newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=1
hxxp://a402.d.akamai.net/check
hxxp://a1205.g.akamai.net/check
hxxp://www.installping5.info/newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=154.239.168.92
hxxp://browserguardian-a.akamaihd.net/protect/block.json194.146.191.107
hxxp://www.installping5.info/id-check/4433e0bcf600ea79ca332930e87765a0/54.239.168.92
hxxp://www.installping5.info/tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=9996554.239.168.92
hxxp://contentcache-a.akamaihd.net/check194.146.191.106
hxxp://www.installping5.info/installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=9996554.239.168.92

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /newuser-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/0/xriderexe/585003/0/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965&os=X&admin=1 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 05 Aug 2015 16:14:34 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 05 Aug 2015 16:14:34 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8F2fUIrY72bbag3_ajx27nryemTQAIKhq_Lkhu0BfGXjmnGd50p5jg==

GET /check HTTP/1.0

Accept: */*

Host: contentcache-a.akamaihd.net

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.0 200 OK

x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN

x-amz-request-id: 03A364489BC8BA6B

Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT

ETag: "2e29635f7002e832ff4ce26f55059e71"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 14

Server: AmazonS3

Date: Wed, 05 Aug 2015 16:15:05 GMT

Connection: keep-alive

{working:true}..

GET /tbi-ping/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: close

Server: nginx/1.8.0

Date: Wed, 05 Aug 2015 16:14:33 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 05 Aug 2015 16:14:33 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Ajzj_ObNBz2lP4yzRh5FO1ERC9s2FTMIssz1-LTSXqYX8FnyUhUHdA==

GET /installer-run/4433e0bcf600ea79ca332930e87765a0/5cc36c09d3851c4f9c6368cf0331e90b/xriderexe/585003/?pid=38997&sub_id=default&uzid=585003&subid=&pid=99965 HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 24

Connection: close

Server: nginx/1.8.0

Date: Wed, 05 Aug 2015 16:14:24 GMT

X-Powered-By: PHP/5.3.3

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Wed, 05 Aug 2015 16:14:24 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -R9XFaIRH2x8savbRel5ORo-Uagx_WNufkH7vFqlhXi_uwYsGkpGOQ==

99965:585003:aug 5, 2015..

GET /check HTTP/1.0

Accept: */*

Host: contentcache-a.akamaihd.net

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.0 200 OK

x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN

x-amz-request-id: 03A364489BC8BA6B

Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT

ETag: "2e29635f7002e832ff4ce26f55059e71"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 14

Server: AmazonS3

Date: Wed, 05 Aug 2015 16:14:35 GMT

Connection: keep-alive

{working:true}..

GET /id-check/4433e0bcf600ea79ca332930e87765a0/ HTTP/1.0

Host: VVV.installping5.info

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 1

Connection: close

Server: nginx/1.8.0

Date: Wed, 05 Aug 2015 16:14:34 GMT

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bVXpt1Y9eZpIskZp2w-5RUC7__gGoPt30xAa_hjo2pJZ_sqtqRVm1A==

1..

GET /protect/block.json HTTP/1.1

Accept: */*

Host: browserguardian-a.akamaihd.net

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: OzW5qr4D Z7f/7J7aKAGXL4o8FJnmlaFNV/1G6TxGphhXrDK9pua81vMdSJAb8JfgTaI/0vpRUY=

x-amz-request-id: EF57647E9BD9F61B

Last-Modified: Wed, 05 Aug 2015 00:05:30 GMT

ETag: "31f5cebdd2bafe0a7eaa23de6a7bd245"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 2275141

Server: AmazonS3

Date: Wed, 05 Aug 2015 16:14:33 GMT

Connection: keep-alive

{"bl": ["hXXp://bw1x.grandcamarade.com/free/c/SIGsend;jsessionid=FE0C22C8BB6CB0D9FD5A612F489A0F1D?loginkey=0320fb01c1a9d2b003e0b813bed3785c8f58fc18a760e0edc7d9ec80da5b334e", "hXXp://ereznir.co.il/System/online/order.php?email=", "hXXp://VVV.colescornerimages.com/aj/index2.php?Fmall.googel/mail/=&elo=178a2f0403fd32addd34a7b00a005b34f&emr=1&hl=en&ltmpl=defalut&ltmplcatce=2&scc=1&ss=1", "http://ccdnigeria.org/wp-admin/VVV.standardbank.co.za/verify/", "hXXp://eishockey-oldies-straubing.de/tmp/library/default.ahx/", "hXXp://VVV.derrick-tienhsin.com/sobresalir.doc", "hXXp://VVV.deportimperium.com/clinic/clinic/md/private", "hXXp://jerryblevinslaw.com/asp/docss/contactform.php", "hXXp://VVV.phone2support.com/wp-includes/images/shop/9398/", "hXXp://bigbearhouseforrent.com/ogbono/Docs/index.php", "hXXp://granby-industriel.com/Dropbox/dropbox/", "hXXp://boss.timeforband.com/newgoodle(1)natasha/2013gdocs", "hXXp://bramwebinar.com/goodtehd/", "http://VVV.bronzetto.ro/filos/file/index.php?userid=", "hXXp://naylorantiques.com/hotsites/qcl5berm/", "hXXp://movingfurnituresaudi.com/wordpress/share (2)/share/share/2015/index.htm", "hXXp://convivir.org/2014/wp-admin/BCC/7c2b12fdb05f38352042176ba97cbe77", "hXXp://fusionfootballodyssey.com/modules/mod_cblogin/cblogin.html", "hXXp://splitapartman.com/folder/DBB/Dropbox/dropbox/index.php", "hXXp://scarpaci.de/tre/H3G_WEB/home.do//51C8DC89FA0EA9A5258177B240F9D5D267D875FB7EA94E866AB44B69B3569F56CBCA7A26F49737819E8AE9F2796CA68BF6CEE49CD7A4BA36743B6A1D92A8",

<<< skipped >>>

GET /check HTTP/1.0

Accept: */*

Host: contentcache-a.akamaihd.net

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.0 200 OK

x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN

x-amz-request-id: 03A364489BC8BA6B

Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT

ETag: "2e29635f7002e832ff4ce26f55059e71"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 14

Server: AmazonS3

Date: Wed, 05 Aug 2015 16:14:45 GMT

Connection: keep-alive

{working:true}..

GET /check HTTP/1.0

Accept: */*

Host: contentcache-a.akamaihd.net

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.0 200 OK

x-amz-id-2: 5rSDl3lGHoY6QmJ0PdYCxXCU28chpitHX mNrwOFLEPt8VdPlYemd3Wn RaHs lN

x-amz-request-id: 03A364489BC8BA6B

Last-Modified: Mon, 03 Feb 2014 16:11:36 GMT

ETag: "2e29635f7002e832ff4ce26f55059e71"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 14

Server: AmazonS3

Date: Wed, 05 Aug 2015 16:14:55 GMT

Connection: keep-alive

{working:true}..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

bservice.exe_268:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

bservice.pdb

bservice.pdb

KERNEL32.dll

KERNEL32.dll

SetWindowsHookExW

SetWindowsHookExW

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

? ?$?(?,?0?4?8?

? ?$?(?,?0?4?8?

4 4@4`4|4

4 4@4`4|4

nKERNEL32.DLL

nKERNEL32.DLL

mscoree.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

bhelper.dll

bhelper.dll

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_bhelper_mutex0

%Program Files%\Bench\BService\1.1\bservice.exe

%Program Files%\Bench\BService\1.1\bservice.exe

wd.exe_280:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

wd.pdb

wd.pdb

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

combase.dll

combase.dll

Amscoree.dll

Amscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

USER32.DLL

USER32.DLL

kernel32.dll

kernel32.dll

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_watchdog_mutex0

\bservice.exe

\bservice.exe

bservice.exe

bservice.exe

\bservice64.exe

\bservice64.exe

bservice64.exe

bservice64.exe

\cservice.exe

\cservice.exe

cservice.exe

cservice.exe

\cservice64.exe

\cservice64.exe

cservice64.exe

cservice64.exe

%Program Files%\Bench\Wd\wd.exe

%Program Files%\Bench\Wd\wd.exe

pwdg.exe_1264:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

operator

operator

GetProcessWindowStation

GetProcessWindowStation

http=

http=

RegOpenKeyTransactedW

RegOpenKeyTransactedW

ProxyWatchdog.pdb

ProxyWatchdog.pdb

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegOpenKeyW

RegOpenKeyW

RegEnumKeyW

RegEnumKeyW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

PSAPI.DLL

PSAPI.DLL

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

WININET.dll

WININET.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

54686

54686

6 7$7(7,7

6 7$7(7,7

9$9(9,9094989

9$9(9,9094989

:(:/:4:8:<:>

:(:/:4:8:<:>

:&;,;0;4;8;

:&;,;0;4;8;

;'

;'

6 6$6(6,6

6 6$6(6,6

2 2

2 2

nKERNEL32.DLL

nKERNEL32.DLL

mscoree.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

settings_url

settings_url

more_info_url

more_info_url

https

https

Advapi32.dll

Advapi32.dll

127.0.0.1

127.0.0.1

%s:%d

%s:%d

hXXp://contentcache-a.akamaihd.net/check

hXXp://contentcache-a.akamaihd.net/check

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running

proc.exe

proc.exe

icon.ico

icon.ico

%Program Files%\Bench\Proxy\pwdg.exe

%Program Files%\Bench\Proxy\pwdg.exe

Otherwise click "Dismiss" and {name} will stop protection from malicious websites. Protection will automatically resume when you restart your computer, unless you uninstall {name}.

Otherwise click "Dismiss" and {name} will stop protection from malicious websites. Protection will automatically resume when you restart your computer, unless you uninstall {name}.

proc.exe_616:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

t.PhhiF

t.PhhiF

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

r%f;M

r%f;M

(function(){if (window.top == window.self){function bindReady(c){function a(){b||(b=!0,c())}var b=!1;if(document.addEventListener)document.addEventListener("DOMContentLoaded",function(){a()},!1);else if(document.attachEvent){if(document.documentElement.doScroll&&window==window.top){var d=function(){if(!b&&document.body)try{document.documentElement.doScroll("left"),a()}catch(c){setTimeout(d,0)}};d()}document.attachEvent("onreadystatechange",function(){"complete"===document.readyState&&a()})}window.addEventListener?window.addEventListener("load",a,!1):window.attachEvent&&window.attachEvent("onload",a)};bindReady(function(){{{medicine}}});}})();

(function(){if (window.top == window.self){function bindReady(c){function a(){b||(b=!0,c())}var b=!1;if(document.addEventListener)document.addEventListener("DOMContentLoaded",function(){a()},!1);else if(document.attachEvent){if(document.documentElement.doScroll&&window==window.top){var d=function(){if(!b&&document.body)try{document.documentElement.doScroll("left"),a()}catch(c){setTimeout(d,0)}};d()}document.attachEvent("onreadystatechange",function(){"complete"===document.readyState&&a()})}window.addEventListener?window.addEventListener("load",a,!1):window.attachEvent&&window.attachEvent("onload",a)};bindReady(function(){{{medicine}}});}})();

(function(){var t=document.createElement('script');t.src ='%s'; document.body.appendChild(t);})();

(function(){var t=document.createElement('script');t.src ='%s'; document.body.appendChild(t);})();

%s: %s

%s: %s

HTTP/1.

HTTP/1.

HTTP/1.0 200 Connection established

HTTP/1.0 200 Connection established

HTTP/1.1 502 Bad Gateway

HTTP/1.1 502 Bad Gateway

HTTP/1.1 504 Gateway Timeout

HTTP/1.1 504 Gateway Timeout

HTTP/1.1 302 Found

HTTP/1.1 302 Found

Location: %redirect_url%

Location: %redirect_url%

HTTP/1.0

HTTP/1.0

HTTP/1.1

HTTP/1.1

HTTP/1.1 200

HTTP/1.1 200

HTTP/1.0 200

HTTP/1.0 200

hXXp://

hXXp://

mozilla

mozilla

chrome

chrome

opera

opera

HTTP/1.0 200 OK

HTTP/1.0 200 OK

Content-length: %d

Content-length: %d

%redirect_url%

%redirect_url%

%blocked_url%

%blocked_url%

RegOpenKeyTransactedW

RegOpenKeyTransactedW

http=

http=

operator

operator

GetProcessWindowStation

GetProcessWindowStation

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

proxy.pdb

proxy.pdb

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

WININET.dll

WININET.dll

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

CryptDestroyKey

CryptDestroyKey

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegEnumKeyW

RegEnumKeyW

RegEnumKeyExW

RegEnumKeyExW

RegOpenKeyW

RegOpenKeyW

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

UrlEscapeW

UrlEscapeW

SHLWAPI.dll

SHLWAPI.dll

PSAPI.DLL

PSAPI.DLL

WTSAPI32.dll

WTSAPI32.dll

RPCRT4.dll

RPCRT4.dll

GetExtendedTcpTable

GetExtendedTcpTable

IPHLPAPI.DLL

IPHLPAPI.DLL

WS2_32.dll

WS2_32.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

.?AVIKeyValueStorage@@

.?AVIKeyValueStorage@@

6074787

6074787

>0?4?8?@?

>0?4?8?@?

? ?$?(?,?0?4?8?

? ?$?(?,?0?4?8?

2 2*20262

2 2*20262

5%6u6W7

5%6u6W7

2-2v2}2

2-2v2}2

4 4$4(4,4044484

4 4$4(4,4044484

6$6(6,606

6$6(6,606

5(5>5]5}5

5(5>5]5}5

7#7'7 7/73777

7#7'7 7/73777

5!5 5?5`5

5!5 5?5`5

34383

34383

=$=,=4=

=$=,=4=

?$?@?`?|?

?$?@?`?|?

kernel32.dll

kernel32.dll

https

https

Server error. Sorry, bro! I don't support batch requests yet. :(

Server error. Sorry, bro! I don't support batch requests yet. :(

db.get

db.get

db.expiration

db.expiration

db.set

db.set

db.remoteset

db.remoteset

db.updateexpiration

db.updateexpiration

db.remove

db.remove

db.keys

db.keys

db.list

db.list

db.clear

db.clear

protect.enabled

protect.enabled

protect.whitelist.add

protect.whitelist.add

protect.whitelist.remove

protect.whitelist.remove

protect.blacklist.add

protect.blacklist.add

protect.blacklist.remove

protect.blacklist.remove

protect.whitelist.list

protect.whitelist.list

protect.blacklist.list

protect.blacklist.list

{7C6A2610-1B02-4086-B5C7-280DAE53B9AD}_keys

{7C6A2610-1B02-4086-B5C7-280DAE53B9AD}_keys

CClientSocket: m_socket = %u, m_dwOwnerPort = %u, m_dwOwnerPid = %u, m_cstrOwnerName = %s

CClientSocket: m_socket = %u, m_dwOwnerPort = %u, m_dwOwnerPid = %u, m_cstrOwnerName = %s

iexplore.exe

iexplore.exe

firefox.exe

firefox.exe

chrome.exe

chrome.exe

@%b %d, %Y

@%b %d, %Y

hXXp://cdnapps-a.akamaihd.net/tb/gz.php?keyset_id={FormatedDate}&xml&rev=0&parent_zone={zoneid}&is_date

hXXp://cdnapps-a.akamaihd.net/tb/gz.php?keyset_id={FormatedDate}&xml&rev=0&parent_zone={zoneid}&is_date

settings_url

settings_url

more_info_url

more_info_url

system_black_list_url

system_black_list_url

protect_redirect_url

protect_redirect_url

"%s" %s

"%s" %s

shell32.dll

shell32.dll

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

Cure added at position %d

Cure added at position %d

01234567

01234567

[INFO] %s

[INFO] %s

[LOG] %s

[LOG] %s

[ERROR] %s

[ERROR] %s

[DEBUG] %s

[DEBUG] %s

Advapi32.dll

Advapi32.dll

yxxxxxxxxxxxxxxxx

yxxxxxxxxxxxxxxxx

\proxy.log

\proxy.log

pwdg.exe

pwdg.exe

Closing socket %d to %s, thread %d

Closing socket %d to %s, thread %d

Reusing socket %d

Reusing socket %d

send failed with error: %d

send failed with error: %d

Hit maximum number of requests on %d, socket will be closed

Hit maximum number of requests on %d, socket will be closed

%s, socket=%d, request=%d

%s, socket=%d, request=%d

Can't find a host name for request on %d, request %d

Can't find a host name for request on %d, request %d

No headers loaded on %d, request %d

No headers loaded on %d, request %d

Socket %d closed after %d requests

Socket %d closed after %d requests

WSAStartup failed with error: %d

WSAStartup failed with error: %d

ListenSocket getaddrinfo failed with error: %d

ListenSocket getaddrinfo failed with error: %d

ListenSocket bind failed with error: %d

ListenSocket bind failed with error: %d

ListenSocket listen failed with error: %d

ListenSocket listen failed with error: %d

Listening on %d

Listening on %d

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running

Global\{4B5DC379-ED06-4552-A736-414A1570C24F}_proxy_running

ListenSocket accept failed with error: %d

ListenSocket accept failed with error: %d

Ws2_32.dll

Ws2_32.dll

combase.dll

combase.dll

Cmscoree.dll

Cmscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

ADVAPI32.DLL

ADVAPI32.DLL

portuguese-brazilian

portuguese-brazilian

USER32.DLL

USER32.DLL

%Program Files%\Bench\Proxy\proc.exe

%Program Files%\Bench\Proxy\proc.exe