Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserProtector-repairJob' = 'wscript.exe "%LOCALAPPDATA%\BrowserProtector\repair.js" "BrowserProtector-repairJob"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService64' = '%ProgramFiles(x86)%\Bench\BService\1.1\bservice64.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%ProgramFiles(x86)%\Bench\Wd\wd.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CService' = '%ProgramFiles(x86)%\Bench\CService\1.0\cservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CService64' = '%ProgramFiles(x86)%\Bench\CService\1.0\cservice64.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserProtector' = ''
Creates or modifies the following files
- %WINDIR%\tasks\bench-sys.job
- <SYSTEM32>\tasks\bench-sys
- %WINDIR%\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001.job
- <SYSTEM32>\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nsbab0e.tmp\system.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\canvasframework\canvasscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\canvasframework\canvas_bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\canvasframework\md5.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\canvasframework\registry.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\canvasframework\webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_webrequest.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\jquery.min.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\backgroundscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\chrome_windows.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\console.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\content_proxy.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\framework.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\i18n.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\base.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\browser.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\io.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\invoke_async.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_common.js
- %ProgramFiles(x86)%\bench\nmhost\nmhost.exe
- %ProgramFiles(x86)%\bench\nmhost\manifest.json
- %ProgramFiles(x86)%\bench\nmhost\data\installer\didfkdocpogamfcjniohejkbmfkaccbm
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_content.js
- %ProgramFiles(x86)%\bench\updater\products.xml
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_settings.js
- %LOCALAPPDATA%\browserprotector\repair_data.json
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe
- %ProgramFiles(x86)%\bench\wd\wd.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\appframework\appapi_browseraction.js
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper.dll
- %ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe
- %ProgramFiles(x86)%\bench\bservice\1.1\bhelper64.dll
- %LOCALAPPDATA%\browserprotector\firefox\framework\base.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\lang.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\icons\icon100.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\icons\icon32.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\icons\icon48.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\background.html
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\icons\button.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\icons\icon128.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\install.rdf
- %APPDATA%\microsoft\windows\start menu\programs\browserprotector\uninstall.lnk
- %ProgramFiles(x86)%\bench\cservice\1.0\chelper.dll
- %ProgramFiles(x86)%\bench\cservice\1.0\cservice.exe
- %ProgramFiles(x86)%\bench\cservice\1.0\chelper64.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\extension_info.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\ui_base.js
- %LOCALAPPDATA%\browserprotector\uninstall.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\options.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\notifications.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\message_target.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\storage.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\timer.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\uninstall.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\userscript_client.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\userscript_engine.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\utils.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\messaging.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\xhr.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\contentnotification.tmpl
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\contentnotificationstyle.tmpl
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\content_notifications.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\context_menu.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\framework_api.js
- %TEMP%\nshbba4.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework-ui\browser_button.js
- %TEMP%\nsbab0e.tmp\nsprocess.dll
- %TEMP%\nshbba3.tmp
- %ProgramFiles(x86)%\bench\updater\updater.exe
- %ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe
- %LOCALAPPDATA%\browserprotector\firefox\install.rdf
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_bg.js
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_browseraction.js
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_common.js
- %LOCALAPPDATA%\browserprotector\firefox\bootstrap.js
- %LOCALAPPDATA%\browserprotector\firefox_installer.js
- %LOCALAPPDATA%\browserprotector\firefox\extension_info.json
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_content.js
- %LOCALAPPDATA%\browserprotector\firefox\canvasframework\canvas_bg.js
- %LOCALAPPDATA%\browserprotector\firefox\canvasframework\canvasscript_engine.js
- %LOCALAPPDATA%\browserprotector\firefox\canvasframework\md5.js
- %LOCALAPPDATA%\browserprotector\firefox\canvasframework\registry.js
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_settings.js
- %LOCALAPPDATA%\browserprotector\firefox\appframework\appapi_webrequest.js
- %LOCALAPPDATA%\browserprotector\firefox\appframework\jquery.min.js
- %LOCALAPPDATA%\browserprotector\firefox\background.html
- %LOCALAPPDATA%\browserprotector\chrome_gp_update.js
- %LOCALAPPDATA%\browserprotector\firefox\canvasframework\webrequest.js
- %TEMP%\nsbab0e.tmp\nsdownloadcv.dll
- %LOCALAPPDATA%\browserprotector\softwaredetector.exe
- %LOCALAPPDATA%\browserprotector\projectinstaller.js
- %LOCALAPPDATA%\browserprotector\installer.js
- %LOCALAPPDATA%\browserprotector\common.js
- %LOCALAPPDATA%\browserprotector\icon.ico
- %TEMP%\nsbab0e.tmp\md5dll.dll
- %LOCALAPPDATA%\browserprotector\main_installer.js
- %LOCALAPPDATA%\browserprotector\migrate.js
- %LOCALAPPDATA%\browserprotector\repair.js
- %LOCALAPPDATA%\browserprotector\gpedit.exe
- %LOCALAPPDATA%\browserprotector\chrome_workaround.js
- %LOCALAPPDATA%\browserprotector\chrome_installer.js
- %LOCALAPPDATA%\browserprotector\sqlite3.exe
- %LOCALAPPDATA%\browserprotector\info.xml
- %ProgramFiles(x86)%\bench\cservice\1.0\cservice64.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3835a3e2-fe60-c529-d8e7-49a1c5a0221c}\framework\legacy.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\backgroundscript_engine.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\console.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\content_notifications.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\context_menu.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\framework_api.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\notifications.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\browser_button.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\options.js
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\contentnotificationstyle.tmpl
- %LOCALAPPDATA%\browserprotector\firefox\icons\button.png
- %LOCALAPPDATA%\browserprotector\firefox\icons\icon128.png
- %LOCALAPPDATA%\browserprotector\firefox\icons\icon32.png
- %LOCALAPPDATA%\browserprotector\firefox\icons\icon48.png
- %TEMP%\nsbab0e.tmp\nsexec.dll
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\ui_base.js
- %LOCALAPPDATA%\browserprotector\firefox\chrome.manifest
- %LOCALAPPDATA%\browserprotector\firefox\icons\icon100.png
- %LOCALAPPDATA%\browserprotector\firefox\framework-ui\contentnotification.tmpl
- %LOCALAPPDATA%\browserprotector\firefox\framework\xhr.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\utils.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\content_proxy.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\framework.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\i18n.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\invoke_async.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\io.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\chrome_windows.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\lang.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\message_target.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\messaging.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\storage.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\timer.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\uninstall.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\userscript_client.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\legacy.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\userscript_engine.js
- %LOCALAPPDATA%\browserprotector\firefox\framework\browser.js
- %LOCALAPPDATA%\benchupdater\products.xml
Deletes the following files
- %TEMP%\nshbba4.tmp
- %LOCALAPPDATA%\browserprotector\info.xml
- %TEMP%\nsbab0e.tmp\md5dll.dll
- %TEMP%\nsbab0e.tmp\nsdownloadcv.dll
- %TEMP%\nsbab0e.tmp\nsexec.dll
- %TEMP%\nsbab0e.tmp\nsprocess.dll
- %TEMP%\nsbab0e.tmp\system.dll
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
Modifies the HOSTS file.
Network activity
Connects to
- '54.##5.90.58':80
UDP
- DNS ASK in####lping5.info
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\BrowserProtector\info.xml"
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%TEMP%\nshBBA4.tmp"
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice.exe'
- '%LOCALAPPDATA%\browserprotector\gpedit.exe' chrome add-extension didfkdocpogamfcjniohejkbmfkaccbm http://di########gamfcjniohejkbmfkaccbm/check/.eJwNyUsOgCAMANG7dE2MbrmMgVKk_GoAjYnx7rKcNy8M0xNowNCkECi4qXWWOmlb1tlc-zA5UwM92kUK6Bk7u_kdO5-c...
- '%ProgramFiles(x86)%\bench\cservice\1.0\cservice.exe'
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%LOCALAPPDATA%\BrowserProtector\info.xml"
- '%ProgramFiles(x86)%\bench\bservice\1.1\bservice64.exe'
- '%ProgramFiles(x86)%\bench\cservice\1.0\cservice64.exe'
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nshBBA4.tmp"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addsystask
- '%LOCALAPPDATA%\browserprotector\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\framework-3835a3e2-fe60-c529-d8e7-49a1c5a0221c.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
- '%LOCALAPPDATA%\browserprotector\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\chrome-extension_didfkdocpogamfcjniohejkbmfkaccbm_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
- '%LOCALAPPDATA%\browserprotector\softwaredetector.exe'
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addtask
- '%ProgramFiles(x86)%\bench\wd\wd.exe'
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addtask
- '%WINDIR%\syswow64\net.exe' start schedule' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /ap...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\BrowserProtector\firefox\" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHos...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\BrowserProtector\firefox" /product-name=...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20141023 /programfiles="C:\Program Files (x86)" /localapps="%LOCALAPPDATA%" /chrome-dir="" /firefox-dir="%LOCALAPPDATA%\BrowserProtector\firefox" /product-name=...
- '%WINDIR%\syswow64\net.exe' start schedule
- '%WINDIR%\syswow64\net1.exe' start schedule
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHos...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199" /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /ap...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install firefox "%LOCALAPPDATA%\BrowserProtector\firefox\" /product-name="BrowserProtector" /installation-time="1602956786" /pid="2235" /zone="23914484" /czoneid="12199...
- '<SYSTEM32>\raserver.exe' /offerraupdate
