Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Guardian-repairJob' = 'wscript.exe "%LOCALAPPDATA%\Browser Guardian\repair.js" "Browser Guardian-repairJob"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService64' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice64.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%ProgramFiles(x86)%\Bench\Wd\wd.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Communicator Watcher' = '%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Settings Cleaner' = '%ProgramFiles(x86)%\Bench\Proxy\cl.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Guardian' = ''
Создает или изменяет следующие файлы
- %WINDIR%\tasks\bench-sys.job
- <SYSTEM32>\tasks\bench-sys
- %WINDIR%\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001.job
- <SYSTEM32>\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8EB46C6E-FBA0-4915-841F-48D7EE9EA777}]
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:3128'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsodaf.tmp\system.dll
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper64.dll
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe
- %ProgramFiles(x86)%\bench\wd\wd.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_browseraction.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_common.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_content.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_settings.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\appapi_webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\appframework\jquery.min.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\top-right.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\canvasframework\canvasscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\canvasframework\md5.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\canvasframework\registry.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\canvasframework\webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\backgroundscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\base.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\browser.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\chrome_windows.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\console.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\content_proxy.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\framework.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\i18n.js
- %LOCALAPPDATA%\browser guardian\repair_data.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\canvasframework\canvas_bg.js
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper.dll
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %ProgramFiles(x86)%\bench\nmhost\data\installer\jkmdneioiggpdolicemlcchhiepfhebm
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\bottom-left.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\bottom-middle.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\bottom-right.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\middle-left.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\middle-right.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\tail-bottom.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\tail-left.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\tail-right.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\tail-top.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\top-left.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\invoke_async.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\theme\bubble\top-middle.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\notifications.js
- %ProgramFiles(x86)%\browser guardian\icons\button.png
- %ProgramFiles(x86)%\browser guardian\icons\icon128.png
- %ProgramFiles(x86)%\browser guardian\icons\icon32.png
- %ProgramFiles(x86)%\browser guardian\icons\icon48.png
- %TEMP%\nsodaf.tmp\nsexec.dll
- %ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe
- %ProgramFiles(x86)%\bench\updater\updater.exe
- %TEMP%\nsr2f51.tmp
- %TEMP%\nsr2f52.tmp
- %ProgramFiles(x86)%\bench\updater\products.xml
- %ProgramFiles(x86)%\bench\nmhost\nmhost.exe
- %ProgramFiles(x86)%\browser guardian\framework-ui\options.js
- %ProgramFiles(x86)%\bench\nmhost\manifest.json
- %ProgramFiles(x86)%\browser guardian\icons\icon100.png
- %ProgramFiles(x86)%\browser guardian\framework-ui\ui_base.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\io.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\messaging.js
- %ProgramFiles(x86)%\bench\proxy\proc.exe
- %ProgramFiles(x86)%\bench\proxy\pwdg.exe
- %ProgramFiles(x86)%\bench\proxy\icon.ico
- %ProgramFiles(x86)%\bench\proxy\cl.exe
- %APPDATA%\microsoft\windows\start menu\programs\browser guardian\browser guardian settings.url
- %APPDATA%\microsoft\windows\start menu\programs\browser guardian\browser guardian.lnk
- %LOCALAPPDATA%\proxy.log
- %LOCALAPPDATA%low\protect\canvasstorage\ee9adb2bad520b37c67f38edc62ec22d
- %LOCALAPPDATA%low\protect\canvasstorage\a645fa10d3b7c3be385a23d8e9796994
- %LOCALAPPDATA%low\protect\canvasstorage\c8ca0d6097bee7d978cc54b0e9075409
- %LOCALAPPDATA%low\protect\canvasstorage\8ab1244a97308124c8207af9517ce460
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\install.rdf
- %LOCALAPPDATA%low\protect\canvasstorage\7bf8e2b7288ee31947f028830fe682c3
- %LOCALAPPDATA%low\protect\blocker\b24f88eb229178ba93accf228dc5b280
- %LOCALAPPDATA%low\protect\blocker\8d3f613ded3421026a6b47abd4042139
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\30p083w4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7ouh8jcs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wjt4t8vb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\csqejufd\desktop.ini
- %APPDATA%\microsoft\windows\start menu\programs\browser guardian\uninstall.lnk
- %LOCALAPPDATA%\browser guardian\clear_cache.js
- %LOCALAPPDATA%\browser guardian\uninstall.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\extension_info.json
- %TEMP%\nsodaf.tmp\nsprocess2.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\storage.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\timer.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\uninstall.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\userscript_client.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\userscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\utils.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\xhr.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\browser_button.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\contentnotification.tmpl
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\contentnotificationstyle.tmpl
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\lang.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\message_target.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework\legacy.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\content_notifications.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\options.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\ui_base.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\icons\button.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\icons\icon100.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\icons\icon128.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\icons\icon32.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\icons\icon48.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\background.html
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\context_menu.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\framework_api.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{9ac3d48e-866f-3eb8-24cb-227784f5741c}\framework-ui\notifications.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\notification.html
- %ProgramFiles(x86)%\browser guardian\framework-ui\framework_api.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\context_menu_item_handler.html
- %LOCALAPPDATA%\browser guardian\firefox\canvasframework\registry.js
- %LOCALAPPDATA%\browser guardian\firefox\canvasframework\webrequest.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\backgroundscript_engine.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\base.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\browser.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\chrome_windows.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\console.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\content_proxy.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\framework.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\i18n.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\invoke_async.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\contentnotification.tmpl
- %LOCALAPPDATA%\browser guardian\firefox\framework\io.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\legacy.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\message_target.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\messaging.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\storage.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\timer.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\uninstall.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\userscript_client.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\userscript_engine.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\utils.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\xhr.js
- %LOCALAPPDATA%\browser guardian\firefox\canvasframework\canvas_bg.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\jquery.min.js
- %LOCALAPPDATA%\browser guardian\firefox\canvasframework\md5.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_webrequest.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_settings.js
- %TEMP%\nsodaf.tmp\md5dll.dll
- %LOCALAPPDATA%\browser guardian\softwaredetector.exe
- %LOCALAPPDATA%\browser guardian\projectinstaller.js
- %LOCALAPPDATA%\browser guardian\installer.js
- %LOCALAPPDATA%\browser guardian\common.js
- %LOCALAPPDATA%\browser guardian\icon.ico
- %LOCALAPPDATA%\browser guardian\main_installer.js
- %LOCALAPPDATA%\browser guardian\info.xml
- %LOCALAPPDATA%\browser guardian\migrate.js
- %LOCALAPPDATA%\browser guardian\repair.js
- %LOCALAPPDATA%\browser guardian\gpedit.exe
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\browser_button.js
- %LOCALAPPDATA%\browser guardian\chrome_workaround.js
- %LOCALAPPDATA%\browser guardian\firefox\framework\lang.js
- %LOCALAPPDATA%\browser guardian\sqlite3.exe
- %LOCALAPPDATA%\browser guardian\firefox_installer.js
- %LOCALAPPDATA%\browser guardian\firefox\background.html
- %LOCALAPPDATA%\browser guardian\firefox\bootstrap.js
- %LOCALAPPDATA%\browser guardian\firefox\chrome.manifest
- %LOCALAPPDATA%\browser guardian\firefox\extension_info.json
- %LOCALAPPDATA%\browser guardian\firefox\install.rdf
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_bg.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_browseraction.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_common.js
- %LOCALAPPDATA%\browser guardian\firefox\appframework\appapi_content.js
- %LOCALAPPDATA%\browser guardian\chrome_installer.js
- %TEMP%\nsodaf.tmp\nsdownloadcv.dll
- %LOCALAPPDATA%\browser guardian\chrome_gp_update.js
- %LOCALAPPDATA%\browser guardian\firefox\canvasframework\canvasscript_engine.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\contentnotificationstyle.tmpl
- %ProgramFiles(x86)%\browser guardian\canvasframework\registry.js
- %ProgramFiles(x86)%\browser guardian\framework\backgroundscript_engine.js
- %ProgramFiles(x86)%\browser guardian\framework\base.js
- %ProgramFiles(x86)%\browser guardian\framework\browser.js
- %ProgramFiles(x86)%\browser guardian\framework\console.js
- %ProgramFiles(x86)%\browser guardian\framework\framework.js
- %ProgramFiles(x86)%\browser guardian\framework\global.js
- %ProgramFiles(x86)%\browser guardian\framework\i18n.js
- %ProgramFiles(x86)%\browser guardian\framework\initialize.js
- %ProgramFiles(x86)%\browser guardian\framework\invoke_async.js
- %ProgramFiles(x86)%\browser guardian\framework\io.js
- %ProgramFiles(x86)%\browser guardian\canvasframework\md5.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\content_notifications.js
- %ProgramFiles(x86)%\browser guardian\canvasframework\webrequest.js
- %ProgramFiles(x86)%\browser guardian\framework\json2.js
- %ProgramFiles(x86)%\browser guardian\framework\messaging.js
- %ProgramFiles(x86)%\browser guardian\framework\storage.js
- %ProgramFiles(x86)%\browser guardian\framework\timer.js
- %ProgramFiles(x86)%\browser guardian\framework\updater.js
- %ProgramFiles(x86)%\browser guardian\framework\userscript_client.js
- %ProgramFiles(x86)%\browser guardian\framework\userscript_engine.js
- %ProgramFiles(x86)%\browser guardian\framework\utils.js
- %ProgramFiles(x86)%\browser guardian\framework\xhr.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\browser_button.js
- %ProgramFiles(x86)%\browser guardian\framework-ui\context_menu.js
- %ProgramFiles(x86)%\browser guardian\framework\lang.js
- %ProgramFiles(x86)%\browser guardian\framework\legacy.js
- %ProgramFiles(x86)%\browser guardian\framework\message_target.js
- %LOCALAPPDATA%\benchupdater\products.xml
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %ProgramFiles(x86)%\browser guardian\appframework\jquery.min.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\framework_api.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\notifications.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\options.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\ui_base.js
- %LOCALAPPDATA%\browser guardian\firefox\icons\button.png
- %LOCALAPPDATA%\browser guardian\firefox\icons\icon100.png
- %LOCALAPPDATA%\browser guardian\firefox\icons\icon128.png
- %LOCALAPPDATA%\browser guardian\firefox\icons\icon32.png
- %LOCALAPPDATA%\browser guardian\firefox\icons\icon48.png
- %LOCALAPPDATA%\browser guardian\ie_installer.js
- %LOCALAPPDATA%\browser guardian\storageedit.exe
- %ProgramFiles(x86)%\browser guardian\canvasframework\canvas_bg.js
- %ProgramFiles(x86)%\browser guardian\canvasframework\canvasscript_engine.js
- %TEMP%\nsodaf.tmp\nsprocess.dll
- %ProgramFiles(x86)%\browser guardian\frameworkbho64.dll
- %ProgramFiles(x86)%\browser guardian\frameworkengine.exe
- %ProgramFiles(x86)%\browser guardian\background.html
- %ProgramFiles(x86)%\browser guardian\config.xml
- %ProgramFiles(x86)%\browser guardian\extension_info.json
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_bg.js
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_browseraction.js
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_common.js
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_content.js
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_settings.js
- %ProgramFiles(x86)%\browser guardian\appframework\appapi_webrequest.js
- %LOCALAPPDATA%\browser guardian\firefox\framework-ui\context_menu.js
- %ProgramFiles(x86)%\browser guardian\frameworkbho.dll
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Присваивает атрибут 'скрытый' для следующих файлов
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\30p083w4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7ouh8jcs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wjt4t8vb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\csqejufd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Удаляет следующие файлы
- %TEMP%\nsr2f52.tmp
- %LOCALAPPDATA%\browser guardian\info.xml
- %TEMP%\nsodaf.tmp\md5dll.dll
- %TEMP%\nsodaf.tmp\nsdownloadcv.dll
- %TEMP%\nsodaf.tmp\nsexec.dll
- %TEMP%\nsodaf.tmp\nsprocess.dll
- %TEMP%\nsodaf.tmp\nsprocess2.dll
- %TEMP%\nsodaf.tmp\system.dll
Подменяет следующие файлы
- %PROGRAMDATA%\ntuser.pol
Изменяет файл HOSTS.
Сетевая активность
TCP
Запросы HTTP GET
- http://br#######ardian-a.akamaihd.net/protect/block.json
- http://co######ache-a.akamaihd.net/check
UDP
- DNS ASK in####lping5.info
- DNS ASK br#######ardian-a.akamaihd.net
- DNS ASK co######ache-a.akamaihd.net
Другое
Ищет следующие окна
- ClassName: '' WindowName: 'Browser Guardian Tray Icon'
Создает и запускает на исполнение
- '%LOCALAPPDATA%\browser guardian\gpedit.exe' chrome add-extension jkmdneioiggpdolicemlcchhiepfhebm http://jk########gpdolicemlcchhiepfhebm/check/.eJwNyUkOgCAQBdG79JoY3XIZg_CVlmYIoDEx3l2W9eqlblogTdbXHEGKbtTGOQ1apnk0p9aNCCrpXi8owtNXduOfIboE...
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nsr2F52.tmp"
- '%ProgramFiles(x86)%\bench\proxy\proc.exe'
- '%ProgramFiles(x86)%\bench\proxy\pwdg.exe'
- '%ProgramFiles(x86)%\browser guardian\frameworkengine.exe' /RegServer
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe'
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe'
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Guardian\info.xml"
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addtask
- '%ProgramFiles(x86)%\bench\wd\wd.exe'
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addtask
- '%LOCALAPPDATA%\browser guardian\softwaredetector.exe'
- '%LOCALAPPDATA%\browser guardian\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jkmdneioiggpdolicemlcchhiepfhebm_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addsystask
- '%LOCALAPPDATA%\browser guardian\storageedit.exe' ie {8EB46C6E-FBA0-4915-841F-48D7EE9EA777} get _GPL_zoneid
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%TEMP%\nsr2F52.tmp"
- '%LOCALAPPDATA%\browser guardian\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\framework-9ac3d48e-866f-3eb8-24cb-227784f5741c.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Guardian\info.xml"
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Guardian\" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost...' (со скрытым окном)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Guardian\firefox\" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199"...' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost...' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app...' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\N...' (со скрытым окном)
- '%WINDIR%\syswow64\net.exe' start schedule' (со скрытым окном)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="%ProgramFiles(x86)%" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Guardian\firefox" /ie-dir="%ProgramF...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="%ProgramFiles(x86)%" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Guardian\firefox" /ie-dir="%ProgramF...
- '%WINDIR%\syswow64\net.exe' start schedule
- '%WINDIR%\syswow64\net1.exe' start schedule
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\N...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Guardian\firefox\" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199"...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Guardian\" /product-name="Browser Guardian" /installation-time="1593696950" /pid="99998" /zone="585003" /czoneid="12199" /nmhost...
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Guardian\FrameworkBHO.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Guardian\FrameworkBHO64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Guardian\FrameworkBHO64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Guardian\RequestHelper.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
