Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bench Communicator Watcher' = '%PROGRAM_FILES%\Bench\Proxy\pwdg.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bench Settings Cleaner' = '%PROGRAM_FILES%\Bench\Proxy\cl.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%PROGRAM_FILES%\Bench\Wd\wd.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserProtector-repairJob' = 'wscript.exe "<LS_APPDATA>\BrowserProtector\repair.js" "BrowserProtector-repairJob"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%PROGRAM_FILES%\Bench\BService\1.1\bservice.exe'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\bench-S-1-5-21-2832440558-3064306045-1455513625-1000.job
- %WINDIR%\Tasks\bench-sys.job
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Bench\BService\1.1\bservice.exe'
- '%PROGRAM_FILES%\Bench\Wd\wd.exe'
- '<LS_APPDATA>\BrowserProtector\sqlite3.exe'
- '%TEMP%\nsh7935.tmp\nsF923.tmp' "<SYSTEM32>\cscript.exe" //Nologo "main_installer.js" install /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILES%\Be...
- '%TEMP%\nsh7935.tmp\nsC17.tmp' "<SYSTEM32>\cscript.exe" //Nologo "installer.js" install chrome "" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILE...
- '%TEMP%\nsh7935.tmp\nsD8DD.tmp' netsh advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\pwdg.exe"
- '%PROGRAM_FILES%\Bench\Proxy\pwdg.exe'
- '%TEMP%\nsh7935.tmp\nsCA7A.tmp' netsh advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\proc.exe"
- '%TEMP%\nsh7935.tmp\ns9C47.tmp' "<SYSTEM32>\cscript.exe" //Nologo "installer.js" install firefox "<LS_APPDATA>\BrowserProtector\firefox\" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czo...
- '%TEMP%\nsh7935.tmp\nsAFA9.tmp' "<SYSTEM32>\cscript.exe" //Nologo "installer.js" install ie "%PROGRAM_FILES%\BrowserProtector\" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="1219...
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nscD50E.tmp"
- '<LS_APPDATA>\BrowserProtector\sqlite3.exe' "%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\framework-3835a3e2-fe60-c529-d8e7-49a1c5a0221c.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
- '<LS_APPDATA>\BrowserProtector\storageedit.exe' ie {804E1B08-EA5D-4546-8B63-9F574BAB5AA3} get _GPL_zoneid
- '<LS_APPDATA>\BrowserProtector\sqlite3.exe' "<LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_didfkdocpogamfcjniohejkbmfkaccbm_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
- '%TEMP%\nsh7935.tmp\ns9712.tmp' "<SYSTEM32>\cscript.exe" //Nologo "migrate.js" /iversion=20141023 /programfiles="%PROGRAM_FILES%" /localapps="<LS_APPDATA>" /chrome-dir="" /firefox-dir="<LS_APPDATA>\BrowserProtector\firefox" /...
- '<LS_APPDATA>\BrowserProtector\SoftwareDetector.exe'
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe' -runmode=addtask
- '%PROGRAM_FILES%\Bench\Updater\updater.exe' -runmode=addproduct -info="%TEMP%\nscD50E.tmp"
- '%PROGRAM_FILES%\Bench\Updater\updater.exe' -runmode=addtask
- '%TEMP%\nsh7935.tmp\nsD58B.tmp' net.exe start schedule
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\Updater.exe' -runmode=addsystask
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\proc.exe"
- '<SYSTEM32>\cscript.exe' //Nologo "installer.js" install ie "%PROGRAM_FILES%\BrowserProtector\" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_...
- '<SYSTEM32>\conhost.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\pwdg.exe"
- '<SYSTEM32>\cscript.exe' 0xfd8 dllhost.exe
- '<SYSTEM32>\conhost.exe' /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
- '<SYSTEM32>\cscript.exe' //Nologo "installer.js" install firefox "<LS_APPDATA>\BrowserProtector\firefox\" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir=...
- '<SYSTEM32>\net1.exe' start schedule
- '<SYSTEM32>\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="%PROGRAM_FILES%" /localapps="<LS_APPDATA>" /chrome-dir="" /firefox-dir="<LS_APPDATA>\BrowserProtector\firefox" /ie-dir="%PROGRAM_FILES%\B...
- '<SYSTEM32>\cscript.exe' //Nologo "main_installer.js" install /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILES%\Bench\NmHost" /app-id="3899...
- '<SYSTEM32>\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="BrowserProtector" /installation-time="1435316582" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILES%\Bench\NmHost" /app-id=...
- '<SYSTEM32>\conhost.exe'
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- chrome.exe
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\bottom-left.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\ui_base.js
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\bottom-middle.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\middle-left.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\bottom-right.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\options.js
- %PROGRAM_FILES%\BrowserProtector\framework-ui\context_menu_item_handler.html
- %PROGRAM_FILES%\BrowserProtector\framework-ui\context_menu.js
- %PROGRAM_FILES%\BrowserProtector\framework-ui\framework_api.js
- %PROGRAM_FILES%\BrowserProtector\framework-ui\notifications.js
- %PROGRAM_FILES%\BrowserProtector\framework-ui\notification.html
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\top-right.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\top-middle.png
- %PROGRAM_FILES%\BrowserProtector\icons\button.png
- %PROGRAM_FILES%\BrowserProtector\icons\icon128.png
- %PROGRAM_FILES%\BrowserProtector\icons\icon100.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\top-left.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\tail-bottom.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\middle-right.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\tail-left.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\tail-top.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\theme\bubble\tail-right.png
- %PROGRAM_FILES%\BrowserProtector\framework-ui\browser_button.js
- %PROGRAM_FILES%\BrowserProtector\framework\initialize.js
- %PROGRAM_FILES%\BrowserProtector\framework\i18n.js
- %PROGRAM_FILES%\BrowserProtector\framework\invoke_async.js
- %PROGRAM_FILES%\BrowserProtector\framework\json2.js
- %PROGRAM_FILES%\BrowserProtector\framework\io.js
- %PROGRAM_FILES%\BrowserProtector\framework\global.js
- %PROGRAM_FILES%\BrowserProtector\framework\base.js
- %PROGRAM_FILES%\BrowserProtector\framework\backgroundscript_engine.js
- %PROGRAM_FILES%\BrowserProtector\framework\browser.js
- %PROGRAM_FILES%\BrowserProtector\framework\framework.js
- %PROGRAM_FILES%\BrowserProtector\framework\console.js
- %PROGRAM_FILES%\BrowserProtector\framework\userscript_client.js
- %PROGRAM_FILES%\BrowserProtector\framework\updater.js
- %PROGRAM_FILES%\BrowserProtector\framework\userscript_engine.js
- %PROGRAM_FILES%\BrowserProtector\framework\xhr.js
- %PROGRAM_FILES%\BrowserProtector\framework\utils.js
- %PROGRAM_FILES%\BrowserProtector\framework\timer.js
- %PROGRAM_FILES%\BrowserProtector\framework\legacy.js
- %PROGRAM_FILES%\BrowserProtector\framework\lang.js
- %PROGRAM_FILES%\BrowserProtector\framework\message_target.js
- %PROGRAM_FILES%\BrowserProtector\framework\storage.js
- %PROGRAM_FILES%\BrowserProtector\framework\messaging.js
- %PROGRAM_FILES%\BrowserProtector\icons\icon32.png
- %TEMP%\nsh7935.tmp\nsD8DD.tmp
- %TEMP%\nsh7935.tmp\nsCA7A.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtector\BrowserProtector Settings.url
- %TEMP%\nsh7935.tmp\ask.exe
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtector\BrowserProtector.lnk
- %PROGRAM_FILES%\Bench\Proxy\cl.exe
- <LS_APPDATA>\BrowserProtector\clear_cache.js
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtector\Uninstall.lnk
- %PROGRAM_FILES%\Bench\Proxy\proc.exe
- %PROGRAM_FILES%\Bench\Proxy\icon.ico
- %PROGRAM_FILES%\Bench\Proxy\pwdg.exe
- %TEMP%\nssE13C.tmp\splash.bmp
- %TEMP%\nscE12B.tmp
- %TEMP%\nssE13C.tmp\nsDownloadCv.dll
- %TEMP%\nssE13C.tmp\System.dll
- %TEMP%\nssE13C.tmp\nsDialogs.dll
- <LS_APPDATA>Low\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3
- <LS_APPDATA>Low\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d
- <LS_APPDATA>\proxy.log
- <LS_APPDATA>Low\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994
- <LS_APPDATA>Low\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460
- <LS_APPDATA>Low\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409
- <LS_APPDATA>\BrowserProtector\uninstall.exe
- %TEMP%\nsh7935.tmp\nsD58B.tmp
- %TEMP%\nscD50E.tmp
- <SYSTEM32>\Tasks\bench-sys
- %PROGRAM_FILES%\Bench\Updater\products.xml
- <SYSTEM32>\Tasks\bench-S-1-5-21-2832440558-3064306045-1455513625-1000
- %TEMP%\nsmD4FD.tmp
- %TEMP%\nsh7935.tmp\nsExec.dll
- %PROGRAM_FILES%\BrowserProtector\icons\icon48.png
- %TEMP%\nsh7935.tmp\ns9712.tmp
- %PROGRAM_FILES%\Bench\Updater\updater.exe
- %PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe
- %PROGRAM_FILES%\Bench\BService\1.1\bservice.exe
- %PROGRAM_FILES%\Bench\BService\1.1\bhelper.dll
- %PROGRAM_FILES%\Bench\Wd\wd.exe
- %TEMP%\nsh7935.tmp\nsAFA9.tmp
- %TEMP%\nsh7935.tmp\ns9C47.tmp
- <Служебный элемент>
- %PROGRAM_FILES%\Bench\NmHost\nmhost.exe
- %TEMP%\nsh7935.tmp\nsF923.tmp
- %PROGRAM_FILES%\Bench\NmHost\manifest.json
- %TEMP%\nsh7935.tmp\ns1FC7.tmp
- %TEMP%\nsh7935.tmp\nsC17.tmp
- <LS_APPDATA>\BrowserProtector\firefox\CanvasFramework\canvasscript_engine.js
- <LS_APPDATA>\BrowserProtector\firefox\CanvasFramework\canvas_bg.js
- <LS_APPDATA>\BrowserProtector\firefox\CanvasFramework\md5.js
- <LS_APPDATA>\BrowserProtector\firefox\CanvasFramework\webrequest.js
- <LS_APPDATA>\BrowserProtector\firefox\CanvasFramework\registry.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\jquery.min.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_common.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_browseraction.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_content.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_webrequest.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_settings.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\i18n.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\framework.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\invoke_async.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\lang.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\io.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\content_proxy.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\base.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\backgroundscript_engine.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\browser.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\console.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\chrome_windows.js
- <LS_APPDATA>\BrowserProtector\firefox\AppFramework\appAPI_bg.js
- <LS_APPDATA>\BrowserProtector\main_installer.js
- <LS_APPDATA>\BrowserProtector\icon.ico
- <LS_APPDATA>\BrowserProtector\info.xml
- <LS_APPDATA>\BrowserProtector\repair.js
- <LS_APPDATA>\BrowserProtector\migrate.js
- <LS_APPDATA>\BrowserProtector\common.js
- %TEMP%\nsh7935.tmp\md5dll.dll
- %TEMP%\nsh7935.tmp\System.dll
- <LS_APPDATA>\BrowserProtector\SoftwareDetector.exe
- <LS_APPDATA>\BrowserProtector\installer.js
- <LS_APPDATA>\BrowserProtector\projectInstaller.js
- <LS_APPDATA>\BrowserProtector\firefox\bootstrap.js
- <LS_APPDATA>\BrowserProtector\firefox\background.html
- <LS_APPDATA>\BrowserProtector\firefox\chrome.manifest
- <LS_APPDATA>\BrowserProtector\firefox\install.rdf
- <LS_APPDATA>\BrowserProtector\firefox\extension_info.json
- <LS_APPDATA>\BrowserProtector\firefox_installer.js
- <LS_APPDATA>\BrowserProtector\chrome_workaround.js
- <LS_APPDATA>\BrowserProtector\gpedit.exe
- <LS_APPDATA>\BrowserProtector\chrome_installer.js
- <LS_APPDATA>\BrowserProtector\chrome_gp_update.js
- <LS_APPDATA>\BrowserProtector\sqlite3.exe
- <LS_APPDATA>\BrowserProtector\firefox\framework\legacy.js
- %PROGRAM_FILES%\BrowserProtector\background.html
- %PROGRAM_FILES%\BrowserProtector\FrameworkEngine.exe
- %PROGRAM_FILES%\BrowserProtector\config.xml
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_bg.js
- %PROGRAM_FILES%\BrowserProtector\extension_info.json
- %PROGRAM_FILES%\BrowserProtector\FrameworkBHO64.dll
- <LS_APPDATA>\BrowserProtector\storageedit.exe
- <LS_APPDATA>\BrowserProtector\ie_installer.js
- %TEMP%\nsh7935.tmp\nsProcess.dll
- %PROGRAM_FILES%\BrowserProtector\FrameworkBHO.dll
- %TEMP%\nsh7935.tmp\nsProcess2.dll
- %PROGRAM_FILES%\BrowserProtector\CanvasFramework\canvasscript_engine.js
- %PROGRAM_FILES%\BrowserProtector\CanvasFramework\canvas_bg.js
- %PROGRAM_FILES%\BrowserProtector\CanvasFramework\md5.js
- %PROGRAM_FILES%\BrowserProtector\CanvasFramework\webrequest.js
- %PROGRAM_FILES%\BrowserProtector\CanvasFramework\registry.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\jquery.min.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_common.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_browseraction.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_content.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_webrequest.js
- %PROGRAM_FILES%\BrowserProtector\AppFramework\appAPI_settings.js
- <LS_APPDATA>\BrowserProtector\firefox\icons\icon48.png
- <LS_APPDATA>\BrowserProtector\firefox\framework\utils.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\userscript_engine.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\xhr.js
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\contentNotification.tmpl
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\browser_button.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\userscript_client.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\messaging.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\message_target.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\storage.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\uninstall.js
- <LS_APPDATA>\BrowserProtector\firefox\framework\timer.js
- <LS_APPDATA>\BrowserProtector\firefox\icons\button.png
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\ui_base.js
- <LS_APPDATA>\BrowserProtector\firefox\icons\icon100.png
- <LS_APPDATA>\BrowserProtector\firefox\icons\icon32.png
- <LS_APPDATA>\BrowserProtector\firefox\icons\icon128.png
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\options.js
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\content_notifications.js
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\contentNotificationStyle.tmpl
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\context_menu.js
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\notifications.js
- <LS_APPDATA>\BrowserProtector\firefox\framework-ui\framework_api.js
Удаляет следующие файлы:
- %TEMP%\nsh7935.tmp\ns9C47.tmp
- %TEMP%\nsh7935.tmp\ns1FC7.tmp
- %TEMP%\nsh7935.tmp\nsAFA9.tmp
- %TEMP%\nsh7935.tmp\nsD8DD.tmp
- %TEMP%\nsh7935.tmp\nsCA7A.tmp
- %TEMP%\nsh7935.tmp\nsD58B.tmp
- %TEMP%\nsh7935.tmp\ns9712.tmp
- %TEMP%\nscD50E.tmp
- %TEMP%\nsh7935.tmp\nsC17.tmp
- %TEMP%\nsh7935.tmp\nsF923.tmp
Изменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'localhost':3128
UDP:
- DNS ASK br#######otector-a.akamaihd.net
- DNS ASK co######ache-a.akamaihd.net
- DNS ASK cd#####s-a.akamaihd.net
- DNS ASK dn#.##ftncsi.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'BrowserProtector Tray Icon'
- ClassName: 'Shell_TrayWnd' WindowName: ''
