Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Warden-repairJob' = 'wscript.exe "%LOCALAPPDATA%\Browser Warden\repair.js" "Browser Warden-repairJob"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService64' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice64.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%ProgramFiles(x86)%\Bench\Wd\wd.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FService' = '%ProgramFiles(x86)%\Bench\FService\1.1\fservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FService64' = '%ProgramFiles(x86)%\Bench\FService\1.1\fservice64.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Communicator Watcher' = '%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bench Settings Cleaner' = '%ProgramFiles(x86)%\Bench\Proxy\cl.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Browser Warden' = ''
- %WINDIR%\tasks\bench-sys.job
- <SYSTEM32>\tasks\bench-sys
- %WINDIR%\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001.job
- <SYSTEM32>\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"
- iexplore.exe
- firefox.exe
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C09954F-CDA8-4BD1-8794-1D543E050378}]
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:3128'
- %TEMP%\nso82f3.tmp\system.dll
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe
- %ProgramFiles(x86)%\bench\wd\wd.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_browseraction.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_common.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\appframework\appapi_webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\canvas.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\canvas_content.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\jquery.min.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\md5.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\registry.js
- %ProgramFiles(x86)%\browser warden\icons\icon128.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\canvasframework\webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\backgroundscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\browser.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\chrome_windows.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\console.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\core.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\extension_info.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\i18n.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\invoke.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\invoke_async.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\io.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\lang.js
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper64.dll
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper.dll
- %LOCALAPPDATA%\browser warden\repair_data.json
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-right.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\middle-left.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\middle-right.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-bottom.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-left.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-right.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\tail-top.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-left.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-middle.png
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\top-right.png
- %ProgramFiles(x86)%\browser warden\icons\button.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\loader.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\api.js
- %ProgramFiles(x86)%\browser warden\icons\icon100.png
- %ProgramFiles(x86)%\browser warden\icons\icon48.png
- %TEMP%\nso82f3.tmp\nsexeccv.dll
- %ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe
- %ProgramFiles(x86)%\bench\updater\updater.exe
- %TEMP%\nsi9a16.tmp
- %TEMP%\nsi9a17.tmp
- %TEMP%\nso82f3.tmp\nsexec.dll
- %ProgramFiles(x86)%\bench\updater\products.xml
- %ProgramFiles(x86)%\bench\nmhost\nmhost.exe
- %ProgramFiles(x86)%\bench\nmhost\manifest.json
- %ProgramFiles(x86)%\bench\nmhost\data\installer\hjjjegfhiceggepdokloeepnhlfnedkk
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-middle.png
- %ProgramFiles(x86)%\browser warden\icons\icon32.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon32.png
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\storage.js
- %ProgramFiles(x86)%\bench\proxy\pwdg.exe
- %ProgramFiles(x86)%\bench\proxy\icon.ico
- %ProgramFiles(x86)%\bench\proxy\cl.exe
- %ProgramFiles(x86)%\bench\proxy\crashhandler.exe
- %APPDATA%\microsoft\windows\start menu\programs\browser warden\browser warden settings.url
- %APPDATA%\microsoft\windows\start menu\programs\browser warden\browser warden.lnk
- %LOCALAPPDATA%\proxy.log
- %LOCALAPPDATA%low\protect\canvasstorage\ee9adb2bad520b37c67f38edc62ec22d
- %LOCALAPPDATA%low\protect\canvasstorage\a645fa10d3b7c3be385a23d8e9796994
- %LOCALAPPDATA%low\protect\canvasstorage\c8ca0d6097bee7d978cc54b0e9075409
- %LOCALAPPDATA%low\protect\canvasstorage\8ab1244a97308124c8207af9517ce460
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\message_target.js
- %LOCALAPPDATA%low\protect\canvasstorage\7bf8e2b7288ee31947f028830fe682c3
- %LOCALAPPDATA%low\protect\blocker\8d3f613ded3421026a6b47abd4042139
- %LOCALAPPDATA%\benchupdater\products.xml
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u66gg3ps\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\63thuujs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hest9z8s\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rl3ed3ok\desktop.ini
- %LOCALAPPDATA%\browser warden\clear_cache.js
- %ProgramFiles(x86)%\bench\proxy\proc.exe
- %APPDATA%\microsoft\windows\start menu\programs\browser warden\uninstall.lnk
- %LOCALAPPDATA%\browser warden\uninstall.exe
- %ProgramFiles(x86)%\bench\fservice\1.1\fservice64.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\uninstall.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\userscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\utils.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\xhr.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\browser_button.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\context_menu.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\framework_api.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\notifications.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework-ui\options.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\button.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon100.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\messaging.js
- %ProgramFiles(x86)%\browser warden\framework-ui\theme\bubble\bottom-left.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon128.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content_loader.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\includes\content_messaging.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\background.html
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\extension_info.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\install.rdf
- %ProgramFiles(x86)%\bench\fservice\1.1\fhelper.dll
- %ProgramFiles(x86)%\bench\fservice\1.1\fservice.exe
- %ProgramFiles(x86)%\bench\fservice\1.1\fhelper64.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\framework\timer.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{79994657-8246-64f3-eabe-44fd7b5d43aa}\icons\icon48.png
- %LOCALAPPDATA%low\protect\blocker\b24f88eb229178ba93accf228dc5b280
- %ProgramFiles(x86)%\browser warden\framework-ui\options.js
- %ProgramFiles(x86)%\browser warden\framework\message_target.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\registry.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\webrequest.js
- %LOCALAPPDATA%\browser warden\firefox\framework\api.js
- %LOCALAPPDATA%\browser warden\firefox\framework\backgroundscript_engine.js
- %LOCALAPPDATA%\browser warden\firefox\framework\browser.js
- %LOCALAPPDATA%\browser warden\firefox\framework\chrome_windows.js
- %LOCALAPPDATA%\browser warden\firefox\framework\console.js
- %LOCALAPPDATA%\browser warden\firefox\framework\core.js
- %LOCALAPPDATA%\browser warden\firefox\framework\extension_info.js
- %LOCALAPPDATA%\browser warden\firefox\framework\i18n.js
- %LOCALAPPDATA%\browser warden\firefox\framework\invoke.js
- %LOCALAPPDATA%\browser warden\gpedit.exe
- %LOCALAPPDATA%\browser warden\firefox\framework\invoke_async.js
- %LOCALAPPDATA%\browser warden\firefox\framework\lang.js
- %LOCALAPPDATA%\browser warden\firefox\framework\loader.js
- %LOCALAPPDATA%\browser warden\firefox\framework\message_target.js
- %LOCALAPPDATA%\browser warden\firefox\framework\messaging.js
- %LOCALAPPDATA%\browser warden\firefox\framework\storage.js
- %LOCALAPPDATA%\browser warden\firefox\framework\timer.js
- %LOCALAPPDATA%\browser warden\firefox\framework\uninstall.js
- %LOCALAPPDATA%\browser warden\firefox\framework\userscript_engine.js
- %LOCALAPPDATA%\browser warden\firefox\framework\utils.js
- %LOCALAPPDATA%\browser warden\firefox\framework\xhr.js
- %LOCALAPPDATA%\browser warden\firefox\framework-ui\browser_button.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\jquery.min.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\md5.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\canvas_content.js
- %LOCALAPPDATA%\browser warden\firefox\canvasframework\canvas.js
- %LOCALAPPDATA%\browser warden\firefox\appframework\appapi_webrequest.js
- %TEMP%\nso82f3.tmp\nsdownloadcv.dll
- %LOCALAPPDATA%\browser warden\softwaredetector.exe
- %LOCALAPPDATA%\browser warden\projectinstaller.js
- %LOCALAPPDATA%\browser warden\installer.js
- %LOCALAPPDATA%\browser warden\canvas.js
- %LOCALAPPDATA%\browser warden\icon.ico
- %LOCALAPPDATA%\browser warden\main_installer.js
- %LOCALAPPDATA%\browser warden\info.xml
- %LOCALAPPDATA%\browser warden\migrate.js
- %LOCALAPPDATA%\browser warden\systeminfo.js
- %LOCALAPPDATA%\browser warden\systemreport.js
- %LOCALAPPDATA%\browser warden\firefox\framework-ui\context_menu.js
- %LOCALAPPDATA%\browser warden\firefox\framework\io.js
- %LOCALAPPDATA%\browser warden\repair.js
- %LOCALAPPDATA%\browser warden\chrome_installer.js
- %LOCALAPPDATA%\browser warden\sqlite3.exe
- %LOCALAPPDATA%\browser warden\firefox_installer.js
- %LOCALAPPDATA%\browser warden\firefox\background.html
- %LOCALAPPDATA%\browser warden\firefox\bootstrap.js
- %LOCALAPPDATA%\browser warden\firefox\chrome.manifest
- %LOCALAPPDATA%\browser warden\firefox\extension_info.json
- %LOCALAPPDATA%\browser warden\firefox\install.rdf
- %LOCALAPPDATA%\browser warden\firefox\appframework\appapi_bg.js
- %LOCALAPPDATA%\browser warden\firefox\appframework\appapi_browseraction.js
- %LOCALAPPDATA%\browser warden\firefox\appframework\appapi_common.js
- %TEMP%\nso82f3.tmp\md5dll.dll
- %LOCALAPPDATA%\browser warden\chrome_workaround.js
- %ProgramFiles(x86)%\browser warden\frameworkbho64.dll
- %ProgramFiles(x86)%\browser warden\framework-ui\notification.html
- %LOCALAPPDATA%\browser warden\firefox\framework-ui\options.js
- %ProgramFiles(x86)%\browser warden\framework\console.js
- %ProgramFiles(x86)%\browser warden\framework\core.js
- %ProgramFiles(x86)%\browser warden\framework\extension_info.js
- %ProgramFiles(x86)%\browser warden\framework\global.js
- %ProgramFiles(x86)%\browser warden\framework\i18n.js
- %ProgramFiles(x86)%\browser warden\framework\initialize.js
- %ProgramFiles(x86)%\browser warden\framework\invoke.js
- %ProgramFiles(x86)%\browser warden\framework\invoke_async.js
- %ProgramFiles(x86)%\browser warden\framework\io.js
- %ProgramFiles(x86)%\browser warden\framework\json2.js
- %ProgramFiles(x86)%\browser warden\framework\lang.js
- %LOCALAPPDATA%\browser warden\firefox\framework-ui\framework_api.js
- %ProgramFiles(x86)%\browser warden\framework\loader.js
- %ProgramFiles(x86)%\browser warden\framework\messaging.js
- %ProgramFiles(x86)%\browser warden\framework\storage.js
- %ProgramFiles(x86)%\browser warden\framework\timer.js
- %ProgramFiles(x86)%\browser warden\framework\updater.js
- %ProgramFiles(x86)%\browser warden\framework\userscript_engine.js
- %ProgramFiles(x86)%\browser warden\framework\utils.js
- %ProgramFiles(x86)%\browser warden\framework\xhr.js
- %ProgramFiles(x86)%\browser warden\framework-ui\browser_button.js
- %ProgramFiles(x86)%\browser warden\framework-ui\context_menu.js
- %ProgramFiles(x86)%\browser warden\framework-ui\context_menu_item_handler.html
- %ProgramFiles(x86)%\browser warden\framework-ui\framework_api.js
- %ProgramFiles(x86)%\browser warden\framework\backgroundscript_engine.js
- %ProgramFiles(x86)%\browser warden\framework\browser.js
- %ProgramFiles(x86)%\browser warden\framework\api.js
- %ProgramFiles(x86)%\browser warden\canvasframework\webrequest.js
- %ProgramFiles(x86)%\browser warden\canvasframework\registry.js
- %LOCALAPPDATA%\browser warden\firefox\icons\icon100.png
- %LOCALAPPDATA%\browser warden\firefox\icons\icon128.png
- %LOCALAPPDATA%\browser warden\firefox\icons\icon32.png
- %LOCALAPPDATA%\browser warden\firefox\icons\icon48.png
- %LOCALAPPDATA%\browser warden\firefox\includes\content.js
- %LOCALAPPDATA%\browser warden\firefox\includes\content_loader.js
- %LOCALAPPDATA%\browser warden\firefox\includes\content_messaging.js
- %LOCALAPPDATA%\browser warden\ie_installer.js
- %LOCALAPPDATA%\browser warden\storageedit.exe
- %TEMP%\nso82f3.tmp\nsprocess.dll
- %TEMP%\nso82f3.tmp\nsprocess2.dll
- %LOCALAPPDATA%\browser warden\firefox\framework-ui\notifications.js
- %ProgramFiles(x86)%\browser warden\framework-ui\notifications.js
- %ProgramFiles(x86)%\browser warden\frameworkbho.dll
- %ProgramFiles(x86)%\browser warden\background.html
- %ProgramFiles(x86)%\browser warden\config.xml
- %ProgramFiles(x86)%\browser warden\extension_info.json
- %ProgramFiles(x86)%\browser warden\appframework\appapi_bg.js
- %ProgramFiles(x86)%\browser warden\appframework\appapi_browseraction.js
- %ProgramFiles(x86)%\browser warden\appframework\appapi_common.js
- %ProgramFiles(x86)%\browser warden\appframework\appapi_webrequest.js
- %ProgramFiles(x86)%\browser warden\canvasframework\canvas.js
- %ProgramFiles(x86)%\browser warden\canvasframework\canvas_content.js
- %ProgramFiles(x86)%\browser warden\canvasframework\jquery.min.js
- %ProgramFiles(x86)%\browser warden\canvasframework\md5.js
- %LOCALAPPDATA%\browser warden\firefox\icons\button.png
- %ProgramFiles(x86)%\browser warden\frameworkengine.exe
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\u66gg3ps\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\63thuujs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hest9z8s\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rl3ed3ok\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %TEMP%\nsi9a17.tmp
- %LOCALAPPDATA%\browser warden\info.xml
- %PROGRAMDATA%\ntuser.pol
- http://cd#####e-a.akamaihd.net/protect/block.json
- http://co######ache-a.akamaihd.net/check
- DNS ASK in####lping5.info
- DNS ASK cd#####e-a.akamaihd.net
- DNS ASK co######ache-a.akamaihd.net
- ClassName: '' WindowName: 'Browser Warden Tray Icon'
- ClassName: 'CrashHandlerAppWindow' WindowName: '{488C949D-6F01-4EF9-A906-F0423F6C17FD}'
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe'
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe'
- '%ProgramFiles(x86)%\bench\proxy\crashhandler.exe' -guid="{488C949D-6F01-4EF9-A906-F0423F6C17FD}"
- '%LOCALAPPDATA%\browser warden\gpedit.exe' chrome add-extension hjjjegfhiceggepdokloeepnhlfnedkk http://hj########eggepdokloeepnhlfnedkk/check/.eJwNyVsKgCAQRuG9zLNEvbaZEP29NyNqEUR7z8fznZeG7pl2MqHJCVJ0o_UoPGlb1tmR-9CloNE-2gVFeMYR7fwhpQTv...
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Warden\info.xml"
- '%ProgramFiles(x86)%\bench\fservice\1.1\fservice64.exe'
- '%ProgramFiles(x86)%\bench\wd\wd.exe'
- '%ProgramFiles(x86)%\bench\fservice\1.1\fservice.exe'
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nsi9A17.tmp"
- '%ProgramFiles(x86)%\bench\proxy\proc.exe'
- '%ProgramFiles(x86)%\bench\proxy\pwdg.exe'
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%TEMP%\nsi9A17.tmp"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addsystask
- '%LOCALAPPDATA%\browser warden\softwaredetector.exe'
- '%LOCALAPPDATA%\browser warden\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hjjjegfhiceggepdokloeepnhlfnedkk_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
- '%LOCALAPPDATA%\browser warden\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\framework-79994657-8246-64f3-eabe-44fd7b5d43aa.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
- '%ProgramFiles(x86)%\browser warden\frameworkengine.exe' /RegServer
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\Browser Warden\info.xml"
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addtask
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addtask
- '%LOCALAPPDATA%\browser warden\storageedit.exe' ie {2C09954F-CDA8-4BD1-8794-1D543E050378} get _GPL_zoneid
- '%WINDIR%\syswow64\net.exe' start schedule' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\proc.exe"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%ProgramFiles(x86)%\Bench\Proxy\pwdg.exe"' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20150820 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Warden\firefox" /ie-dir="%Program...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Warden\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir=...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Warden\firefox\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmh...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHo...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "systemreport.js" /url="https://s.snadhgo.com/submit_report" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /version="1.0" /...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20150820 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\Browser Warden\firefox" /ie-dir="%Program...
- '%WINDIR%\syswow64\net.exe' start schedule
- '%WINDIR%\syswow64\net1.exe' start schedule
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHo...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\Browser Warden\firefox\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmh...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install ie "%ProgramFiles(x86)%\Browser Warden\" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /nmhost-dir=...
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\FrameworkBHO64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Browser Warden\RequestHelper.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cscript.exe' //Nologo "systemreport.js" /url="https://s.snadhgo.com/submit_report" /product-name="Browser Warden" /installation-time="1598102204" /pid="2071" /zone="763116" /czoneid="12199" /version="1.0" /...
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1