Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bench Settings Cleaner' = '%PROGRAM_FILES%\Bench\Proxy\cl.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bench Communicator Watcher' = '%PROGRAM_FILES%\Bench\Proxy\pwdg.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Savings Season-repairJob' = 'wscript.exe "<LS_APPDATA>\Savings Season\repair.js" "Savings Season-repairJob"'
- %WINDIR%\Tasks\bench-S-1-5-21-2832440558-3064306045-1455513625-1000.job
- %WINDIR%\Tasks\bench-sys.job
- '%TEMP%\nscD568.tmp\ns6905.tmp' "<SYSTEM32>\cscript.exe" //Nologo "main_installer.js" install /product-name="Savings Season" /installation-time="1435270801" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILES%\Benc...
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nsx3F45.tmp"
- '%PROGRAM_FILES%\Bench\Updater\updater.exe' -runmode=addproduct -info="%TEMP%\nsx3F45.tmp"
- '%TEMP%\nscD568.tmp\ns7C57.tmp' "<SYSTEM32>\cscript.exe" //Nologo "installer.js" install firefox "<LS_APPDATA>\Savings Season\firefox\" /product-name="Savings Season" /installation-time="1435270801" /pid="" /zone="" /czoneid...
- '%TEMP%\nscD568.tmp\ask.exe'
- '%PROGRAM_FILES%\Bench\Updater\updater.exe' /pid=0x87c /log
- '%TEMP%\nscD568.tmp\nsA942.tmp' netsh advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\proc.exe"
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe' -runmode=addtask
- '<LS_APPDATA>\Savings Season\sqlite3.exe' "%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\framework-ab246b9e-3215-cc06-bffe-fd1325ef3c9e.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
- '<LS_APPDATA>\Savings Season\SoftwareDetector.exe'
- '%TEMP%\nscD568.tmp\ns530.tmp' "<SYSTEM32>\cscript.exe" //Nologo "migrate.js" /iversion=20141023 /programfiles="%PROGRAM_FILES%" /localapps="<LS_APPDATA>" /firefox-dir="<LS_APPDATA>\Savings Season\firefox" /ie-dir="%PROGRAM_...
- '<LS_APPDATA>\Savings Season\storageedit.exe' ie {77AE02BE-8EF5-43D6-9271-1FC448D63DE2} get _GPL_zoneid
- '%PROGRAM_FILES%\Bench\Updater\updater.exe' -runmode=addtask
- '%PROGRAM_FILES%\Bench\Updater\1.7.0.0\Updater.exe' -runmode=addsystask
- '%TEMP%\nscD568.tmp\ns3FE2.tmp' net.exe start schedule
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\pwdg.exe"
- '<SYSTEM32>\conhost.exe' netsh advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="%PROGRAM_FILES%\Bench\Proxy\pwdg.exe"
- '<SYSTEM32>\conhost.exe' /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
- '<SYSTEM32>\taskhost.exe'
- '<SYSTEM32>\net1.exe' start schedule
- '<SYSTEM32>\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="%PROGRAM_FILES%" /localapps="<LS_APPDATA>" /firefox-dir="<LS_APPDATA>\Savings Season\firefox" /ie-dir="%PROGRAM_FILES%\Savings Season" /...
- '<SYSTEM32>\cscript.exe' 0x9ac ns7c57.tmp
- '<SYSTEM32>\cscript.exe' //Nologo "main_installer.js" install /product-name="Savings Season" /installation-time="1435270801" /pid="" /zone="" /czoneid="12199" /nmhost-dir="%PROGRAM_FILES%\Bench\NmHost" /app-id="38960"...
- firefox.exe
- iexplore.exe
- %PROGRAM_FILES%\Savings Season\framework-ui\notifications.js
- %PROGRAM_FILES%\Savings Season\framework-ui\notification.html
- %PROGRAM_FILES%\Savings Season\framework-ui\options.js
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\bottom-left.png
- %PROGRAM_FILES%\Savings Season\framework-ui\ui_base.js
- %PROGRAM_FILES%\Savings Season\framework-ui\browser_button.js
- %PROGRAM_FILES%\Savings Season\framework\xhr.js
- %PROGRAM_FILES%\Savings Season\framework-ui\context_menu.js
- %PROGRAM_FILES%\Savings Season\framework-ui\framework_api.js
- %PROGRAM_FILES%\Savings Season\framework-ui\context_menu_item_handler.html
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\bottom-middle.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\tail-top.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\tail-right.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\top-left.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\top-right.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\top-middle.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\middle-left.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\bottom-right.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\middle-right.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\tail-left.png
- %PROGRAM_FILES%\Savings Season\framework-ui\theme\bubble\tail-bottom.png
- %PROGRAM_FILES%\Savings Season\framework\utils.js
- %PROGRAM_FILES%\Savings Season\framework\global.js
- %PROGRAM_FILES%\Savings Season\framework\framework.js
- %PROGRAM_FILES%\Savings Season\framework\i18n.js
- %PROGRAM_FILES%\Savings Season\framework\invoke_async.js
- %PROGRAM_FILES%\Savings Season\framework\initialize.js
- %PROGRAM_FILES%\Savings Season\framework\backgroundscript_engine.js
- %PROGRAM_FILES%\Savings Season\CanvasFramework\webrequest.js
- %PROGRAM_FILES%\Savings Season\framework\base.js
- %PROGRAM_FILES%\Savings Season\framework\console.js
- %PROGRAM_FILES%\Savings Season\framework\browser.js
- %PROGRAM_FILES%\Savings Season\framework\io.js
- %PROGRAM_FILES%\Savings Season\framework\timer.js
- %PROGRAM_FILES%\Savings Season\framework\storage.js
- %PROGRAM_FILES%\Savings Season\framework\updater.js
- %PROGRAM_FILES%\Savings Season\framework\userscript_engine.js
- %PROGRAM_FILES%\Savings Season\framework\userscript_client.js
- %PROGRAM_FILES%\Savings Season\framework\lang.js
- %PROGRAM_FILES%\Savings Season\framework\json2.js
- %PROGRAM_FILES%\Savings Season\framework\legacy.js
- %PROGRAM_FILES%\Savings Season\framework\messaging.js
- %PROGRAM_FILES%\Savings Season\framework\message_target.js
- %TEMP%\nscD568.tmp\nsC442.tmp
- %TEMP%\nscD568.tmp\nsA942.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Savings Season\Browser Guardian Settings.url
- <LS_APPDATA>\proxy.log
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Savings Season\Browser Guardian.lnk
- %PROGRAM_FILES%\Bench\Proxy\proc.exe
- <LS_APPDATA>\Savings Season\clear_cache.js
- %PROGRAM_FILES%\Bench\Proxy\pwdg.exe
- %PROGRAM_FILES%\Bench\Proxy\cl.exe
- %PROGRAM_FILES%\Bench\Proxy\icon.ico
- %TEMP%\nscD568.tmp\ask.exe
- %TEMP%\nsxD96F.tmp\splash.bmp
- %TEMP%\nsxD920.tmp
- %TEMP%\nsxD96F.tmp\nsDownloadCv.dll
- %TEMP%\nsxD96F.tmp\System.dll
- %TEMP%\nsxD96F.tmp\nsDialogs.dll
- <LS_APPDATA>Low\Protect\CanvasStorage\a645fa10d3b7c3be385a23d8e9796994
- <LS_APPDATA>Low\Protect\CanvasStorage\ee9adb2bad520b37c67f38edc62ec22d
- <LS_APPDATA>Low\Protect\CanvasStorage\c8ca0d6097bee7d978cc54b0e9075409
- <LS_APPDATA>Low\Protect\CanvasStorage\7bf8e2b7288ee31947f028830fe682c3
- <LS_APPDATA>Low\Protect\CanvasStorage\8ab1244a97308124c8207af9517ce460
- <LS_APPDATA>\Savings Season\chrome_installer.js
- %TEMP%\nscD568.tmp\ns530.tmp
- %TEMP%\nscD568.tmp\nsExec.dll
- %PROGRAM_FILES%\Bench\Updater\1.7.0.0\updater.exe
- %TEMP%\nsh3F34.tmp
- %PROGRAM_FILES%\Bench\Updater\updater.exe
- %PROGRAM_FILES%\Savings Season\icons\icon100.png
- %PROGRAM_FILES%\Savings Season\icons\button.png
- %PROGRAM_FILES%\Savings Season\icons\icon128.png
- %PROGRAM_FILES%\Savings Season\icons\icon48.png
- %PROGRAM_FILES%\Savings Season\icons\icon32.png
- %TEMP%\nsx3F45.tmp
- <Auxiliary element>
- %TEMP%\nscD568.tmp\ns7C57.tmp
- %TEMP%\nscD568.tmp\ns9007.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Savings Season\Uninstall.lnk
- <LS_APPDATA>\Savings Season\uninstall.exe
- <SYSTEM32>\Tasks\bench-sys
- %TEMP%\nscD568.tmp\ns3FE2.tmp
- <SYSTEM32>\Tasks\bench-S-1-5-21-2832440558-3064306045-1455513625-1000
- %TEMP%\nscD568.tmp\ns6905.tmp
- %PROGRAM_FILES%\Bench\Updater\products.xml
- <LS_APPDATA>\Savings Season\firefox\CanvasFramework\registry.js
- <LS_APPDATA>\Savings Season\firefox\CanvasFramework\md5.js
- <LS_APPDATA>\Savings Season\firefox\CanvasFramework\webrequest.js
- <LS_APPDATA>\Savings Season\firefox\framework\base.js
- <LS_APPDATA>\Savings Season\firefox\framework\backgroundscript_engine.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_webrequest.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_settings.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\jquery.min.js
- <LS_APPDATA>\Savings Season\firefox\CanvasFramework\canvasscript_engine.js
- <LS_APPDATA>\Savings Season\firefox\CanvasFramework\canvas_bg.js
- <LS_APPDATA>\Savings Season\firefox\framework\browser.js
- <LS_APPDATA>\Savings Season\firefox\framework\io.js
- <LS_APPDATA>\Savings Season\firefox\framework\invoke_async.js
- <LS_APPDATA>\Savings Season\firefox\framework\lang.js
- <LS_APPDATA>\Savings Season\firefox\framework\message_target.js
- <LS_APPDATA>\Savings Season\firefox\framework\legacy.js
- <LS_APPDATA>\Savings Season\firefox\framework\console.js
- <LS_APPDATA>\Savings Season\firefox\framework\chrome_windows.js
- <LS_APPDATA>\Savings Season\firefox\framework\content_proxy.js
- <LS_APPDATA>\Savings Season\firefox\framework\i18n.js
- <LS_APPDATA>\Savings Season\firefox\framework\framework.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_content.js
- <LS_APPDATA>\Savings Season\icon.ico
- <LS_APPDATA>\Savings Season\common.js
- <LS_APPDATA>\Savings Season\main_installer.js
- <LS_APPDATA>\Savings Season\migrate.js
- <LS_APPDATA>\Savings Season\info.xml
- %TEMP%\nscD568.tmp\md5dll.dll
- %TEMP%\nscD568.tmp\System.dll
- <LS_APPDATA>\Savings Season\SoftwareDetector.exe
- <LS_APPDATA>\Savings Season\installer.js
- <LS_APPDATA>\Savings Season\projectInstaller.js
- <LS_APPDATA>\Savings Season\repair.js
- <LS_APPDATA>\Savings Season\firefox\install.rdf
- <LS_APPDATA>\Savings Season\firefox\extension_info.json
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_bg.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_common.js
- <LS_APPDATA>\Savings Season\firefox\AppFramework\appAPI_browseraction.js
- <LS_APPDATA>\Savings Season\firefox_installer.js
- <LS_APPDATA>\Savings Season\sqlite3.exe
- <LS_APPDATA>\Savings Season\firefox\background.html
- <LS_APPDATA>\Savings Season\firefox\chrome.manifest
- <LS_APPDATA>\Savings Season\firefox\bootstrap.js
- %PROGRAM_FILES%\Savings Season\FrameworkEngine.exe
- %PROGRAM_FILES%\Savings Season\FrameworkBHO64.dll
- %PROGRAM_FILES%\Savings Season\background.html
- %PROGRAM_FILES%\Savings Season\extension_info.json
- %PROGRAM_FILES%\Savings Season\config.xml
- <LS_APPDATA>\Savings Season\storageedit.exe
- <LS_APPDATA>\Savings Season\ie_installer.js
- %TEMP%\nscD568.tmp\nsProcess.dll
- %PROGRAM_FILES%\Savings Season\FrameworkBHO.dll
- %TEMP%\nscD568.tmp\nsProcess2.dll
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_bg.js
- %PROGRAM_FILES%\Savings Season\CanvasFramework\canvas_bg.js
- %PROGRAM_FILES%\Savings Season\AppFramework\jquery.min.js
- %PROGRAM_FILES%\Savings Season\CanvasFramework\canvasscript_engine.js
- %PROGRAM_FILES%\Savings Season\CanvasFramework\registry.js
- %PROGRAM_FILES%\Savings Season\CanvasFramework\md5.js
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_common.js
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_browseraction.js
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_content.js
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_webrequest.js
- %PROGRAM_FILES%\Savings Season\AppFramework\appAPI_settings.js
- <LS_APPDATA>\Savings Season\firefox\icons\icon48.png
- <LS_APPDATA>\Savings Season\firefox\framework\utils.js
- <LS_APPDATA>\Savings Season\firefox\framework\userscript_engine.js
- <LS_APPDATA>\Savings Season\firefox\framework\xhr.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\contentNotification.tmpl
- <LS_APPDATA>\Savings Season\firefox\framework-ui\browser_button.js
- <LS_APPDATA>\Savings Season\firefox\framework\storage.js
- <LS_APPDATA>\Savings Season\firefox\framework\messaging.js
- <LS_APPDATA>\Savings Season\firefox\framework\timer.js
- <LS_APPDATA>\Savings Season\firefox\framework\userscript_client.js
- <LS_APPDATA>\Savings Season\firefox\framework\uninstall.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\contentNotificationStyle.tmpl
- <LS_APPDATA>\Savings Season\firefox\icons\button.png
- <LS_APPDATA>\Savings Season\firefox\framework-ui\ui_base.js
- <LS_APPDATA>\Savings Season\firefox\icons\icon100.png
- <LS_APPDATA>\Savings Season\firefox\icons\icon32.png
- <LS_APPDATA>\Savings Season\firefox\icons\icon128.png
- <LS_APPDATA>\Savings Season\firefox\framework-ui\context_menu.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\content_notifications.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\framework_api.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\options.js
- <LS_APPDATA>\Savings Season\firefox\framework-ui\notifications.js
- %TEMP%\nscD568.tmp\ns9007.tmp
- %TEMP%\nscD568.tmp\ns7C57.tmp
- %TEMP%\nscD568.tmp\nsC442.tmp
- %TEMP%\nscD568.tmp\nsA942.tmp
- %TEMP%\nscD568.tmp\ns3FE2.tmp
- %TEMP%\nscD568.tmp\ns530.tmp
- %TEMP%\nscD568.tmp\ns6905.tmp
- %TEMP%\nsx3F45.tmp
- 'localhost':3128
- DNS ASK dn#.##ftncsi.com
- DNS ASK cd#####s-a.akamaihd.net
- DNS ASK co######ache-a.akamaihd.net
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Savings Season Tray Icon'