Trojan.Crossrider1.56180

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Warden-repairJob' = 'wscript.exe "%LOCALAPPDATA%\Browser Warden\repair.js" "Browser Warden-repairJob"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService64' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice64.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%ProgramFiles(x86)%\Bench\Wd\wd.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FService' = '%ProgramFiles(x86)%\Bench\FService\1.1\fservice.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FService64' = '%ProgramFiles(x86)%\Bench\FService\1.1\fservice64.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Communicator Watcher' = '%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Settings Cleaner' = '%ProgramFiles(x86)%\Bench\Proxy\cl.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Warden' = ''

Creates or modifies the following files

%WINDIR%\tasks\bench-sys.job
<SYSTEM32>\tasks\bench-sys
%WINDIR%\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001.job
<SYSTEM32>\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Registers BHO

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C09954F-CDA8-4BD1-8794-1D543E050378}]

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:3128'

Modifies file system

Creates the following files

%TEMP%\nso82f3.tmp\system.dll
%ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe
%ProgramFiles(x86)%\bench\wd\wd.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_bg.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_browseraction.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_common.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_webrequest.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\canvas.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\canvas_content.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\jquery.min.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\md5.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\registry.js
%ProgramFiles(x86)%\browser warden\icons\icon128.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\webrequest.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\backgroundscript_engine.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\browser.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\chrome_windows.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\console.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\core.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\extension_info.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\i18n.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\invoke.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\invoke_async.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\io.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\lang.js
%ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe
%ProgramFiles(x86)%\bench\bservice\1.1\bhelper64.dll
%ProgramFiles(x86)%\bench\bservice\1.1\bhelper.dll
%LOCALAPPDATA%\browser warden\repair_data.json
%WINDIR%\syswow64\grouppolicy\gpt.ini
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-right.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\middle-left.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\middle-right.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-bottom.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-left.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-right.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-top.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-left.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-middle.png
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-right.png
%ProgramFiles(x86)%\browser warden\icons\button.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\loader.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\api.js
%ProgramFiles(x86)%\browser warden\icons\icon100.png
%ProgramFiles(x86)%\browser warden\icons\icon48.png
%TEMP%\nso82f3.tmp\nsexeccv.dll
%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe
%ProgramFiles(x86)%\bench\updater\updater.exe
%TEMP%\nsi9a16.tmp
%TEMP%\nsi9a17.tmp
%TEMP%\nso82f3.tmp\nsexec.dll
%ProgramFiles(x86)%\bench\updater\products.xml
%ProgramFiles(x86)%\bench\nmhost\nmhost.exe
%ProgramFiles(x86)%\bench\nmhost\manifest.json
%ProgramFiles(x86)%\bench\nmhost\data\installer\hjjjegfhiceggepdokloeepnhlfnedkk
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-middle.png
%ProgramFiles(x86)%\browser warden\icons\icon32.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon32.png
%APPDATA%\microsoft\windows\cookies\low\index.dat
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\storage.js
%ProgramFiles(x86)%\bench\proxy\pwdg.exe
%ProgramFiles(x86)%\bench\proxy\icon.ico
%ProgramFiles(x86)%\bench\proxy\cl.exe
%ProgramFiles(x86)%\bench\proxy\crashhandler.exe
%APPDATA%\microsoft\windows\start menu\programs\browser warden\browser warden settings.url
%APPDATA%\microsoft\windows\start menu\programs\browser warden\browser warden.lnk
%LOCALAPPDATA%\proxy.log
%LOCALAPPDATA%low\protect\canvasstorage\ee9adb2bad520b37c67f38edc62ec22d
%LOCALAPPDATA%low\protect\canvasstorage\a645fa10d3b7c3be385a23d8e9796994
%LOCALAPPDATA%low\protect\canvasstorage\c8ca0d6097bee7d978cc54b0e9075409
%LOCALAPPDATA%low\protect\canvasstorage\8ab1244a97308124c8207af9517ce460
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\message_target.js
%LOCALAPPDATA%low\protect\canvasstorage\7bf8e2b7288ee31947f028830fe682c3
%LOCALAPPDATA%low\protect\blocker\8d3f613ded3421026a6b47abd4042139
%LOCALAPPDATA%\benchupdater\products.xml
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u66gg3ps\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\63thuujs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hest9z8s\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rl3ed3ok\desktop.ini
%LOCALAPPDATA%\browser warden\clear_cache.js
%ProgramFiles(x86)%\bench\proxy\proc.exe
%APPDATA%\microsoft\windows\start menu\programs\browser warden\uninstall.lnk
%LOCALAPPDATA%\browser warden\uninstall.exe
%ProgramFiles(x86)%\bench\fservice\1.1\fservice64.exe
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\uninstall.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\userscript_engine.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\utils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\xhr.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\browser_button.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\context_menu.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\framework_api.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\notifications.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\options.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\button.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon100.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\messaging.js
%ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-left.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon128.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content_loader.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content_messaging.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\background.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\bootstrap.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\extension_info.json
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\install.rdf
%ProgramFiles(x86)%\bench\fservice\1.1\fhelper.dll
%ProgramFiles(x86)%\bench\fservice\1.1\fservice.exe
%ProgramFiles(x86)%\bench\fservice\1.1\fhelper64.dll
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\timer.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon48.png
%LOCALAPPDATA%low\protect\blocker\b24f88eb229178ba93accf228dc5b280
%ProgramFiles(x86)%\browser warden\framework-ui\options.js
%ProgramFiles(x86)%\browser warden\framework\message_target.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\registry.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\webrequest.js
%LOCALAPPDATA%\browser warden\firefox\framework\api.js
%LOCALAPPDATA%\browser warden\firefox\framework\backgroundscript_engine.js
%LOCALAPPDATA%\browser warden\firefox\framework\browser.js
%LOCALAPPDATA%\browser warden\firefox\framework\chrome_windows.js
%LOCALAPPDATA%\browser warden\firefox\framework\console.js
%LOCALAPPDATA%\browser warden\firefox\framework\core.js
%LOCALAPPDATA%\browser warden\firefox\framework\extension_info.js
%LOCALAPPDATA%\browser warden\firefox\framework\i18n.js
%LOCALAPPDATA%\browser warden\firefox\framework\invoke.js
%LOCALAPPDATA%\browser warden\gpedit.exe
%LOCALAPPDATA%\browser warden\firefox\framework\invoke_async.js
%LOCALAPPDATA%\browser warden\firefox\framework\lang.js
%LOCALAPPDATA%\browser warden\firefox\framework\loader.js
%LOCALAPPDATA%\browser warden\firefox\framework\message_target.js
%LOCALAPPDATA%\browser warden\firefox\framework\messaging.js
%LOCALAPPDATA%\browser warden\firefox\framework\storage.js
%LOCALAPPDATA%\browser warden\firefox\framework\timer.js
%LOCALAPPDATA%\browser warden\firefox\framework\uninstall.js
%LOCALAPPDATA%\browser warden\firefox\framework\userscript_engine.js
%LOCALAPPDATA%\browser warden\firefox\framework\utils.js
%LOCALAPPDATA%\browser warden\firefox\framework\xhr.js
%LOCALAPPDATA%\browser warden\firefox\framework-ui\browser_button.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\jquery.min.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\md5.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\canvas_content.js
%LOCALAPPDATA%\browser warden\firefox\canvasframework\canvas.js
%LOCALAPPDATA%\browser warden\firefox\appframework\appapi_webrequest.js
%TEMP%\nso82f3.tmp\nsdownloadcv.dll
%LOCALAPPDATA%\browser warden\softwaredetector.exe
%LOCALAPPDATA%\browser warden\projectinstaller.js
%LOCALAPPDATA%\browser warden\installer.js
%LOCALAPPDATA%\browser warden\canvas.js
%LOCALAPPDATA%\browser warden\icon.ico
%LOCALAPPDATA%\browser warden\main_installer.js
%LOCALAPPDATA%\browser warden\info.xml
%LOCALAPPDATA%\browser warden\migrate.js
%LOCALAPPDATA%\browser warden\systeminfo.js
%LOCALAPPDATA%\browser warden\systemreport.js
%LOCALAPPDATA%\browser warden\firefox\framework-ui\context_menu.js
%LOCALAPPDATA%\browser warden\firefox\framework\io.js
%LOCALAPPDATA%\browser warden\repair.js
%LOCALAPPDATA%\browser warden\chrome_installer.js
%LOCALAPPDATA%\browser warden\sqlite3.exe
%LOCALAPPDATA%\browser warden\firefox_installer.js
%LOCALAPPDATA%\browser warden\firefox\background.html
%LOCALAPPDATA%\browser warden\firefox\bootstrap.js
%LOCALAPPDATA%\browser warden\firefox\chrome.manifest
%LOCALAPPDATA%\browser warden\firefox\extension_info.json
%LOCALAPPDATA%\browser warden\firefox\install.rdf
%LOCALAPPDATA%\browser warden\firefox\appframework\appapi_bg.js
%LOCALAPPDATA%\browser warden\firefox\appframework\appapi_browseraction.js
%LOCALAPPDATA%\browser warden\firefox\appframework\appapi_common.js
%TEMP%\nso82f3.tmp\md5dll.dll
%LOCALAPPDATA%\browser warden\chrome_workaround.js
%ProgramFiles(x86)%\browser warden\frameworkbho64.dll
%ProgramFiles(x86)%\browser warden\framework-ui\notification.html
%LOCALAPPDATA%\browser warden\firefox\framework-ui\options.js
%ProgramFiles(x86)%\browser warden\framework\console.js
%ProgramFiles(x86)%\browser warden\framework\core.js
%ProgramFiles(x86)%\browser warden\framework\extension_info.js
%ProgramFiles(x86)%\browser warden\framework\global.js
%ProgramFiles(x86)%\browser warden\framework\i18n.js
%ProgramFiles(x86)%\browser warden\framework\initialize.js
%ProgramFiles(x86)%\browser warden\framework\invoke.js
%ProgramFiles(x86)%\browser warden\framework\invoke_async.js
%ProgramFiles(x86)%\browser warden\framework\io.js
%ProgramFiles(x86)%\browser warden\framework\json2.js
%ProgramFiles(x86)%\browser warden\framework\lang.js
%LOCALAPPDATA%\browser warden\firefox\framework-ui\framework_api.js
%ProgramFiles(x86)%\browser warden\framework\loader.js
%ProgramFiles(x86)%\browser warden\framework\messaging.js
%ProgramFiles(x86)%\browser warden\framework\storage.js
%ProgramFiles(x86)%\browser warden\framework\timer.js
%ProgramFiles(x86)%\browser warden\framework\updater.js
%ProgramFiles(x86)%\browser warden\framework\userscript_engine.js
%ProgramFiles(x86)%\browser warden\framework\utils.js
%ProgramFiles(x86)%\browser warden\framework\xhr.js
%ProgramFiles(x86)%\browser warden\framework-ui\browser_button.js
%ProgramFiles(x86)%\browser warden\framework-ui\context_menu.js
%ProgramFiles(x86)%\browser warden\framework-ui\context_menu_item_handler.html
%ProgramFiles(x86)%\browser warden\framework-ui\framework_api.js
%ProgramFiles(x86)%\browser warden\framework\backgroundscript_engine.js
%ProgramFiles(x86)%\browser warden\framework\browser.js
%ProgramFiles(x86)%\browser warden\framework\api.js
%ProgramFiles(x86)%\browser warden\canvasframework\webrequest.js
%ProgramFiles(x86)%\browser warden\canvasframework\registry.js
%LOCALAPPDATA%\browser warden\firefox\icons\icon100.png
%LOCALAPPDATA%\browser warden\firefox\icons\icon128.png
%LOCALAPPDATA%\browser warden\firefox\icons\icon32.png
%LOCALAPPDATA%\browser warden\firefox\icons\icon48.png
%LOCALAPPDATA%\browser warden\firefox\includes\content.js
%LOCALAPPDATA%\browser warden\firefox\includes\content_loader.js
%LOCALAPPDATA%\browser warden\firefox\includes\content_messaging.js
%LOCALAPPDATA%\browser warden\ie_installer.js
%LOCALAPPDATA%\browser warden\storageedit.exe
%TEMP%\nso82f3.tmp\nsprocess.dll
%TEMP%\nso82f3.tmp\nsprocess2.dll
%LOCALAPPDATA%\browser warden\firefox\framework-ui\notifications.js
%ProgramFiles(x86)%\browser warden\framework-ui\notifications.js
%ProgramFiles(x86)%\browser warden\frameworkbho.dll
%ProgramFiles(x86)%\browser warden\background.html
%ProgramFiles(x86)%\browser warden\config.xml
%ProgramFiles(x86)%\browser warden\extension_info.json
%ProgramFiles(x86)%\browser warden\appframework\appapi_bg.js
%ProgramFiles(x86)%\browser warden\appframework\appapi_browseraction.js
%ProgramFiles(x86)%\browser warden\appframework\appapi_common.js
%ProgramFiles(x86)%\browser warden\appframework\appapi_webrequest.js
%ProgramFiles(x86)%\browser warden\canvasframework\canvas.js
%ProgramFiles(x86)%\browser warden\canvasframework\canvas_content.js
%ProgramFiles(x86)%\browser warden\canvasframework\jquery.min.js
%ProgramFiles(x86)%\browser warden\canvasframework\md5.js
%LOCALAPPDATA%\browser warden\firefox\icons\button.png
%ProgramFiles(x86)%\browser warden\frameworkengine.exe
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u66gg3ps\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\63thuujs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hest9z8s\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rl3ed3ok\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

%TEMP%\nsi9a17.tmp
%LOCALAPPDATA%\browser warden\info.xml

Substitutes the following files

%PROGRAMDATA%\ntuser.pol

Modifies the HOSTS file.

Network activity

TCP

HTTP GET requests

http://cd#####e-a.akamaihd.net/protect/block.json
http://co######ache-a.akamaihd.net/check

'localhost':49175

'localhost':49177

'localhost':49179

UDP

DNS ASK in####lping5.info
DNS ASK cd#####e-a.akamaihd.net
DNS ASK co######ache-a.akamaihd.net

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Browser Warden Tray Icon'
ClassName: 'CrashHandlerAppWindow' WindowName: '{488C949D-6F01-4EF9-A906-F0423F6C17FD}'

Creates and executes the following

'%ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe'
'%ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe'
'%ProgramFiles(x86)%\bench\proxy\crashhandler.exe' -guid="{488C949D-6F01-4EF9-A906-F0423F6C17FD}"
'%LOCALAPPDATA%\browser warden\gpedit.exe' chrome add-extension hjjjegfhiceggepdokloeepnhlfnedkk http://hj########eggepdokloeepnhlfnedkk/check/.eJwNyVsKgCAQRuG9zLNEvbaZEP29NyNqEUR7z8fznZeG7pl2MqHJCVJ0o_UoPGlb1tmR-9CloNE-2gVFeMYR7fwhpQTv...
'%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Warden\info.xml"
'%ProgramFiles(x86)%\bench\fservice\1.1\fservice64.exe'
'%ProgramFiles(x86)%\bench\wd\wd.exe'
'%ProgramFiles(x86)%\bench\fservice\1.1\fservice.exe'
'%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nsi9A17.tmp"
'%ProgramFiles(x86)%\bench\proxy\proc.exe'
'%ProgramFiles(x86)%\bench\proxy\pwdg.exe'
'%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%TEMP%\nsi9A17.tmp"
'%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addsystask
'%LOCALAPPDATA%\browser warden\softwaredetector.exe'
'%LOCALAPPDATA%\browser warden\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hjjjegfhiceggepdokloeepnhlfnedkk_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
'%LOCALAPPDATA%\browser warden\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\framework-79994657-8246-64f3-eabe-44fd7b5d43aa.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
'%ProgramFiles(x86)%\browser warden\frameworkengine.exe' /RegServer
'%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Warden\info.xml"
'%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addtask
'%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addtask
'%LOCALAPPDATA%\browser warden\storageedit.exe' ie {2C09954F-CDA8-4BD1-8794-1D543E050378} get _GPL_zoneid
'%WINDIR%\syswow64\net.exe' start schedule' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20150820 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Warden\firefox" /ie-dir="%Program...' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Warden\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir=...' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Warden\firefox\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmh...' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHo...' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /...' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' //Nologo "systemreport.js" /url="https://s.snadhgo.com/submit_report" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /version="1.0" /...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20150820 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Warden\firefox" /ie-dir="%Program...
'%WINDIR%\syswow64\net.exe' start schedule
'%WINDIR%\syswow64\net1.exe' start schedule
'%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /...
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHo...
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Warden\firefox\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmh...
'%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Warden\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir=...
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO64.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO64.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\RequestHelper.dll"
'<SYSTEM32>\raserver.exe' /offerraupdate
'%WINDIR%\syswow64\cscript.exe' //Nologo "systemreport.js" /url="https://s.snadhgo.com/submit_report" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /version="1.0" /...
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial