Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nskd5f5.tmp
- %TEMP%\nszd605.tmp\system.dll
- %TEMP%\nszd605.tmp\mixer.exe
- %TEMP%\nszd605.tmp\temp_file_before.tmp
- %TEMP%\nszd605.tmp\execdos.dll
- %TEMP%\nszd605.tmp\vid-saver-internalinstaller.exe
- %TEMP%\nszd605.tmp\stdutils.dll
- %TEMP%\nspe15a.tmp
- %TEMP%\nspe15b.tmp\stdutils.dll
- %TEMP%\nspe15b.tmp\system.dll
- %TEMP%\nspe15b.tmp\nsislog.dll
- %TEMP%\vid-saverinstaller_1754501849.log
- %TEMP%\nspe15b.tmp\dialer.dll
- %TEMP%\nspe15b.tmp\nsisos.dll
- %TEMP%\nspe15b.tmp\md5dll.dll
- %TEMP%\nspe15b.tmp\userinfo.dll
- %TEMP%\nspe15b.tmp\inetc.dll
- %TEMP%\nspe15b.tmp\mixer.exe
- %TEMP%\nspe15b.tmp\temp_file_before.tmp
- %TEMP%\nspe15b.tmp\execdos.dll
- %TEMP%\nspe15b.tmp\temp_file_after.tmp
- %TEMP%\nspe15b.tmp\installer_util.exe
- %ProgramFiles(x86)%\vid-saver\vid-saver.exe
- %ProgramFiles(x86)%\vid-saver\vid-saver-bg.exe
- %ProgramFiles(x86)%\vid-saver\buttonutil.dll
- %ProgramFiles(x86)%\vid-saver\vid-saver.dll
- %ProgramFiles(x86)%\vid-saver\vid-saver.ico
- %TEMP%\nspe15b.tmp\text.txt
- %ProgramFiles(x86)%\vid-saver\vid-saver.ini
- %ProgramFiles(x86)%\vid-saver\uninstall.exe
- %TEMP%\nspe15b.tmp\vid-saver.xpi
- %TEMP%\nspe15b.tmp\zipdll.dll
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\install.rdf
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\search_dialog.xul
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\extensioncode\backgroundcode.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\extensioncode\pagecode.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\options.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\lib\reports.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\background.html
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\dialog.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\browser.xul
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\crossrider.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\crossriderext.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\options.xul
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\crossriderapi.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome\content\update.html
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\button4.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\popup_binding.xml
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\button3.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\icon24.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\popup.html
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\panelarrow-up.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\skin.css
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\button5.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\popup.css
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\icon48.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\crossrider_statusbar.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\icon16.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\button2.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\icon128.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\update.css
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\skin\button1.png
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\defaults\preferences\prefs.js
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\crossriderapp3491@crossrider.com\locale\en-us\translations.dtd
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\prefs.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\install.rdf
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\search_dialog.xul
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\extensioncode\backgroundcode.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\extensioncode\pagecode.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\options.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\lib\reports.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\background.html
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\dialog.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\browser.xul
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\crossrider.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\crossriderext.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\options.xul
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\crossriderapi.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome\content\update.html
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\button4.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\popup_binding.xml
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\button3.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\icon24.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\popup.html
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\panelarrow-up.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\skin.css
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\button5.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\popup.css
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\icon48.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\crossrider_statusbar.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\icon16.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\button2.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\icon128.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\update.css
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\skin\button1.png
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\defaults\preferences\prefs.js
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\crossriderapp3491@crossrider.com\locale\en-us\translations.dtd
- %LOCALAPPDATA%\vid-saver\chrome\vid-saver.crx
- %TEMP%\nspe15b.tmp\removefromlist.vbs
- %TEMP%\nsfe36.tmp
- %TEMP%\nspe15b.tmp\cleanchromeprefs.vbs
- %TEMP%\nsu128a.tmp
- %TEMP%\nspe15b.tmp\scs.exe
- %TEMP%\nspe15b.tmp\cookiedbindex.bat
- %TEMP%\nspe15b.tmp\cookiedbindex.txt
- %LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1
- %LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1-journal
- %ProgramFiles(x86)%\vid-saver\vid-saverinstaller.log
Deletes the following files
- %TEMP%\nspe15b.tmp\removefromlist.vbs
- %TEMP%\nspe15b.tmp\cleanchromeprefs.vbs
- %LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1-journal
- %TEMP%\nspe15b.tmp\cookiedbindex.bat
- %TEMP%\nspe15b.tmp\cookiedbindex.txt
- %TEMP%\nspe15b.tmp\dialer.dll
- %TEMP%\nspe15b.tmp\execdos.dll
- %TEMP%\nspe15b.tmp\inetc.dll
- %TEMP%\nspe15b.tmp\installer_util.exe
- %TEMP%\nspe15b.tmp\md5dll.dll
- %TEMP%\nspe15b.tmp\mixer.exe
- %TEMP%\nspe15b.tmp\nsislog.dll
- %TEMP%\nspe15b.tmp\nsisos.dll
- %TEMP%\nspe15b.tmp\scs.exe
- %TEMP%\nspe15b.tmp\stdutils.dll
- %TEMP%\nspe15b.tmp\system.dll
- %TEMP%\nspe15b.tmp\temp_file_after.tmp
- %TEMP%\nspe15b.tmp\temp_file_before.tmp
- %TEMP%\nspe15b.tmp\text.txt
- %TEMP%\nspe15b.tmp\userinfo.dll
- %TEMP%\nspe15b.tmp\vid-saver.xpi
- %TEMP%\nspe15b.tmp\zipdll.dll
- %TEMP%\nszd605.tmp\execdos.dll
- %TEMP%\nszd605.tmp\mixer.exe
- %TEMP%\nszd605.tmp\stdutils.dll
- %TEMP%\nszd605.tmp\system.dll
- %TEMP%\nszd605.tmp\temp_file_before.tmp
- %TEMP%\nszd605.tmp\vid-saver-internalinstaller.exe
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db
Substitutes the following files
- %TEMP%\nspe15b.tmp\removefromlist.vbs
- %TEMP%\nspe15b.tmp\cleanchromeprefs.vbs
- %LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1-journal
Network activity
UDP
- DNS ASK st###.#rossrider.com
- DNS ASK pi###track.com
- DNS ASK ap######ic.crossrider.com
- DNS ASK er####.crossrider.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\nszd605.tmp\mixer.exe' "%TEMP%\nszD605.tmp\temp_file_before.tmp" "%TEMP%\nszD605.tmp\Vid-Saver-InternalInstaller.exe" 215617c015910130db8869aeaed8c0cb
- '%TEMP%\nszd605.tmp\vid-saver-internalinstaller.exe'
- '%TEMP%\nspe15b.tmp\mixer.exe' "%TEMP%\nspE15B.tmp\temp_file_before.tmp" "%TEMP%\nspE15B.tmp\temp_file_after.tmp" 2021e6e015910130db8369aeaed8c0cb
- '%TEMP%\nspe15b.tmp\installer_util.exe' /checkmachine
- '%TEMP%\nspe15b.tmp\installer_util.exe' /closebrowsers /closeie /closeff
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\nspE15B.tmp\RemoveFromList.vbs
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\nspE15B.tmp\CleanChromePrefs.vbs
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "SELECT id FROM Databases WHERE name = 'crossrider_cookies_3491' LIMIT 1"
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "INSERT INTO Databases (origin, name, description, estimated_size) VALUES('chrome-extension_pgmfkblbflahhponhjmkcnpjinenh...
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallerParams','{\"value\" ...
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationTime','{\"value\"...
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationThankYouPage','{\...
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO internaldb (name,value,expires) values('InstallerIdentifiers','{\"...
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO internaldb (name,value,expires) values('SoftwareDetected','{\"valu...
- '%ProgramFiles(x86)%\vid-saver\vid-saver.exe' /installapp=3491 /executebgcode
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Vid-Saver\Vid-Saver.dll"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nspE15B.tmp\CookieDbIndex.bat
- '%TEMP%\nszd605.tmp\mixer.exe' "%TEMP%\nszD605.tmp\temp_file_before.tmp" "%TEMP%\nszD605.tmp\Vid-Saver-InternalInstaller.exe" 215617c015910130db8869aeaed8c0cb' (with hidden window)
- '%TEMP%\nspe15b.tmp\mixer.exe' "%TEMP%\nspE15B.tmp\temp_file_before.tmp" "%TEMP%\nspE15B.tmp\temp_file_after.tmp" 2021e6e015910130db8369aeaed8c0cb' (with hidden window)
- '%TEMP%\nspe15b.tmp\installer_util.exe' /checkmachine' (with hidden window)
- '%TEMP%\nspe15b.tmp\installer_util.exe' /closebrowsers /closeie /closeff' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Vid-Saver\Vid-Saver.dll"' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\nspE15B.tmp\RemoveFromList.vbs' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\nspE15B.tmp\CleanChromePrefs.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nspE15B.tmp\CookieDbIndex.bat' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "INSERT INTO Databases (origin, name, description, estimated_size) VALUES('chrome-extension_pgmfkblbflahhponhjmkcnpjinenh...' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallerParams','{\"value\" ...' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationTime','{\"value\"...' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationThankYouPage','{\...' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO internaldb (name,value,expires) values('InstallerIdentifiers','{\"...' (with hidden window)
- '%TEMP%\nspe15b.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_pgmfkblbflahhponhjmkcnpjinenhlnc_0\1" "REPLACE INTO internaldb (name,value,expires) values('SoftwareDetected','{\"valu...' (with hidden window)
- '%ProgramFiles(x86)%\vid-saver\vid-saver.exe' /installapp=3491 /executebgcode' (with hidden window)
