Trojan.Siggen9.61257

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{f799ba47-be7f-4fe6-93b2-6f143cc57193}' = '"%PROGRAMDATA%\Package Cache\{f799ba47-be7f-4fe6-93b2-6f143cc57193}\HSS-7.0.5-...

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM hsscp.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM FBWMgr.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM FBW.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM af_proxy_cmd.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM af_proxy_cmd_rep.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM openvpn.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM hydra.exe
'%WINDIR%\syswow64\net.exe' stop HssWd
'%WINDIR%\syswow64\taskkill.exe' /F /IM hsswd.exe
'%WINDIR%\syswow64\net.exe' stop HssTrayService
'%WINDIR%\syswow64\taskkill.exe' /F /IM HssTrayService.exe
'%WINDIR%\syswow64\net.exe' stop hshld
'%WINDIR%\syswow64\taskkill.exe' /F /IM cmw_srv.exe

Modifies file system

Creates the following files

%TEMP%\autc7d6.tmp
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-por.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-per.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-kor.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-jpn.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-ind.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-ger.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-fre.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-eng.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-chi.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-spa.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-rus.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\greenico.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\google_music_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\fxservicebridge.dll
%ProgramFiles(x86)%\hotspot shield\bin\fxntfbridge.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\faq.html
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\facebook_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\espn_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\error.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\enable_unblock.html
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-bur.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting24.png
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-tur.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.managedadapter.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.landing.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.datapath.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.configuration.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.common.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.backend.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\hss.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\hss.png
%ProgramFiles(x86)%\hotspot shield\hss.ico
%ProgramFiles(x86)%\hotspot shield\bin\hss.common.wcf.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.common.rpc.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.common.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.ui.viewmodel.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.ui.view.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.ui.auxiliary.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.services.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.management.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.framework.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.common.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\hover.html
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\hbo_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\elite_message_style.css
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-ara.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\ebay_icon.png
%PROGRAMDATA%\hotspot shield\config\dnr.cfg
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\disconnecting.gif
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting16.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting16.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connecting.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\connecting.gif
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected24.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connected24.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connected24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected20.png
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.management.dll
%ProgramFiles(x86)%\hotspot shield\bin\lang\gui-vie.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting24.png
%ProgramFiles(x86)%\hotspot shield\bin\crashrpt_lang.ini
%ProgramFiles(x86)%\hotspot shield\htdocs\connecting24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected24.png
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected24.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected16.png
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected16.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\disconnected12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\disconnected12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\cwtv_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\crunchyroll_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\crashsender1403.exe
%ProgramFiles(x86)%\hotspot shield\bin\crashrpt1403.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\country-list.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\logo_hss.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\youtube_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\hsscp.exe
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\temp_banner.png
%ProgramFiles(x86)%\hotspot shield\bin\tapinstall.exe
%ProgramFiles(x86)%\hotspot shield\driver\taphss6.sys
%ProgramFiles(x86)%\hotspot shield\driver\taphss6.inf
%ProgramFiles(x86)%\hotspot shield\driver\taphss6.cat
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\t.gif
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\styles2.css
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\styles.css
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\style_v2.css
%ProgramFiles(x86)%\hotspot shield\htdocs\tooltip.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\template_v2.html
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\preuninstall\search.png
%ProgramFiles(x86)%\hotspot shield\sdpkg\sdpkg_resource.dll
%ProgramFiles(x86)%\hotspot shield\sdpkg\sdhss.cfg
%ProgramFiles(x86)%\hotspot shield\config\sd-info-main.cfg
%ProgramFiles(x86)%\hotspot shield\config\sd-info-direct.cfg
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\safe.html
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\s.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\s.png
%PROGRAMDATA%\hotspot shield\config\proxy.pac
%ProgramFiles(x86)%\hotspot shield\bin\speed.gif
%ProgramFiles(x86)%\hotspot shield\bin\hss.service.messaging.dll
%ProgramFiles(x86)%\hotspot shield\bin\trafmgr_1_3_32.sys
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\yahoo_screen_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\yahoo_icon.png
%ProgramFiles(x86)%\hotspot shield\hsswpr\wpr.conf
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\wifisec.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\wifi_protected.html
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\weibo_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\vistahlp.dll
%ProgramFiles(x86)%\hotspot shield\bin\vcruntime140.dll
%ProgramFiles(x86)%\hotspot shield\bin\vccorlib140.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\upgd\upgrading.html
%ProgramFiles(x86)%\hotspot shield\htdocs\updatestatus.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\update.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\unsafe.html
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\unblock_doms.html
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-4.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-3.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-2.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-1.png
%ProgramFiles(x86)%\hotspot shield\bin\ucrtbase.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\twitter_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\trafmgrclnt.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\proxy.js
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\slice_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\prism.wpf.dll
%ProgramFiles(x86)%\hotspot shield\bin\prism.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\preuninstall.html
%ProgramFiles(x86)%\hotspot shield\bin\libeay32.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\img\logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\loading.html
%ProgramFiles(x86)%\hotspot shield\htdocs\upgd\loader.gif
%ProgramFiles(x86)%\hotspot shield\htdocs\img\loade.gif
%ProgramFiles(x86)%\hotspot shield\license.txt
%ProgramFiles(x86)%\hotspot shield\bin\libssl32.dll
%ProgramFiles(x86)%\hotspot shield\bin\libidn-11.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\lang.js
%ProgramFiles(x86)%\hotspot shield\htdocs\upgd\logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\l.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\joy_game_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\itv_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\instagram_icon.png
%ProgramFiles(x86)%\hotspot shield\config\icooff.cfg
%ProgramFiles(x86)%\hotspot shield\bin\hydra.exe
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\hulu_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe
%ProgramFiles(x86)%\hotspot shield\bin\hsscp.exe.config
%ProgramFiles(x86)%\hotspot shield\bin\hss.trayntf.exe
%ProgramFiles(x86)%\hotspot shield\htdocs\connected20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\logo_big.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\mal_rep.html
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\preuninstall\logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\ppomppu_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\pic_ok.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\pic_attention.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\pandora_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\openvpn.exe
%ProgramFiles(x86)%\hotspot shield\htdocs\oac.html
%ProgramFiles(x86)%\hotspot shield\bin\ntf.dll
%ProgramFiles(x86)%\hotspot shield\bin\nlog.dll
%ProgramFiles(x86)%\hotspot shield\bin\nlog.config
%ProgramFiles(x86)%\hotspot shield\bin\ninject.dll
%ProgramFiles(x86)%\hotspot shield\bin\newtonsoft.json.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\newhs.html
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\netflix_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\nbc_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\mtv_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\msvcp140.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\mlb_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\message.html
%ProgramFiles(x86)%\hotspot shield\htdocs\menu.html
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\manifest.json
%ProgramFiles(x86)%\hotspot shield\htdocs\mail.html
%ProgramFiles(x86)%\hotspot shield\bin\trafmgr_1_3_64.sys
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\cannot_unblock.html
%WINDIR%\installer\msibbda.tmp-\setup.helper.dll
%WINDIR%\installer\msibbda.tmp-\setup.common.dll
%WINDIR%\installer\msibbda.tmp-\customaction.config
%WINDIR%\installer\msibbda.tmp-\setup.actions.dll
%WINDIR%\installer\msiabdb.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msiabdb.tmp-\wixsharp.dll
%WINDIR%\installer\msiabdb.tmp-\setup.helper.dll
%WINDIR%\installer\msiabdb.tmp-\setup.common.dll
%WINDIR%\installer\msiabdb.tmp-\customaction.config
%WINDIR%\installer\msibbda.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msibbda.tmp-\wixsharp.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\hotspotshieldpackageid
%PROGRAMDATA%\package cache\{f799ba47-be7f-4fe6-93b2-6f143cc57193}\state.rsm
%PROGRAMDATA%\package cache\{f799ba47-be7f-4fe6-93b2-6f143cc57193}\hss-7.0.5-install-plain-773-plain.exe
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.be\hss-7.0.5-install-plain-773-plain.exe
%PROGRAMDATA%\hotspot shield\rep\events.raw
%TEMP%\hotspot_shield_7.0.5_20200725003127.log
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\bootstrapperapplicationdata.xml
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\regcleaner.exe
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1053\mbapreq.wxl
%WINDIR%\installer\msiabdb.tmp-\setup.actions.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1049\mbapreq.wxl
%WINDIR%\installer\msic3bb.tmp-\setup.actions.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-string-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-memory-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-handle-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-libraryloader-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-errorhandling-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\microsoft.practices.servicelocation.dll
%WINDIR%\installer\msi123a.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi123a.tmp-\wixsharp.dll
%WINDIR%\installer\msi123a.tmp-\setup.helper.dll
%WINDIR%\installer\msi123a.tmp-\setup.common.dll
%WINDIR%\installer\msi123a.tmp-\customaction.config
%WINDIR%\installer\msi123a.tmp-\setup.actions.dll
%WINDIR%\installer\msic3bb.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msic3bb.tmp-\wixsharp.dll
%WINDIR%\installer\msic3bb.tmp-\setup.helper.dll
%WINDIR%\installer\msic3bb.tmp-\setup.common.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1029\mbapreq.wxl
%TEMP%\hotspot_shield_7.0.5_20200725003127_000_hotspotshieldpackageid.log
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\mbapreq.png
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\zh.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\vi.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1030\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1043\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1042\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1041\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1040\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1038\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1036\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1035\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1032\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1031\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1028\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1045\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\mbapreq.thm
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\mbapreq.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\bootstrappercore.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\mbahost.dll
%TEMP%\{7dc714f7-1182-41d2-88d7-5068a41b89b4}\.cr\~wqicrbj.tmp
%TEMP%\~rhgczub.tmp
%TEMP%\autdf08.tmp
%TEMP%\~wqicrbj.tmp
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\installer\msic3bb.tmp-\customaction.config
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1046\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1055\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1044\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\tr.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\ru.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\pt.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\ko.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\ja.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\fr.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\fa.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\es.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\en.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\de.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\lang\ar.tsv
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\microsoft.deployment.windowsinstaller.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\setup.common.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\interop.shdocvw.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\bootstrappercore.config
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\setup.bootstrapper.dll
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\3082\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\2070\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\2052\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1060\mbapreq.wxl
%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.ba\1051\mbapreq.wxl
%ProgramFiles(x86)%\hotspot shield\bin\de\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected16.png
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.management.contract.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\bbc_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\bandwidth_fbw_logo.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\bandwidth_fbw_graf.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\bandwidth_fbw_close.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\bandwidth_fbw.html
%ProgramFiles(x86)%\hotspot shield\htdocs\automode24.png
%ProgramFiles(x86)%\hotspot shield\htdocs\automode24.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\automode20.png
%ProgramFiles(x86)%\hotspot shield\htdocs\automode20.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\bg_attention.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\preuninstall\bg.png
%ProgramFiles(x86)%\hotspot shield\htdocs\automode12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\automode12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\automode.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\auto_connect_template.html
%ProgramFiles(x86)%\hotspot shield\htdocs\applaunch.html
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\anim_v2.js
%ProgramFiles(x86)%\hotspot shield\htdocs\automode16.png
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-namedpipe-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\blank.html
%ProgramFiles(x86)%\hotspot shield\htdocs\connected16.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connected16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connected12.png
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\connected12.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\icons\connected.png
%ProgramFiles(x86)%\hotspot shield\htdocs\connected.png
%ProgramFiles(x86)%\hotspot shield\config\config.hvpn
%ProgramFiles(x86)%\hotspot shield\bin\concrt140.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\common.js
%ProgramFiles(x86)%\hotspot shield\htdocs\common.css
%ProgramFiles(x86)%\hotspot shield\bin\cmw_srv.exe.config
%ProgramFiles(x86)%\hotspot shield\bin\cmw_srv.exe
%ProgramFiles(x86)%\hotspot shield\bin\cmw_srv.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\upgd\close.png
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\img\close.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\chanel4_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\cfghlp_cmd64.exe
%ProgramFiles(x86)%\hotspot shield\bin\cfghlp.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\ntf\anim.js
%ProgramFiles(x86)%\hotspot shield\htdocs\automode16.bmp
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\amc_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\amazonprime_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\amazon_icon.png
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-interlocked-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-util-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-heap-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-file-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-sysinfo-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-profile-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-console-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\hss.client.notification.contract.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-synch-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-debug-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\microsoft.expression.interactions.dll
%ProgramFiles(x86)%\hotspot shield\bin\hardcodet.wpf.taskbarnotification.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-processthreads-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\connected20.bmp
%ProgramFiles(x86)%\hotspot shield\bin\ru\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\fr\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\afvpn.dll
%ProgramFiles(x86)%\hotspot shield\bin\e646a07e-07ea-4e26-8aa5-2dacc20e35dc.dll
%ProgramFiles(x86)%\hotspot shield\driver\af2.cer
%ProgramFiles(x86)%\hotspot shield\driver\af16.cer
%ProgramFiles(x86)%\hotspot shield\driver\af.cer
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\ad.png
%ProgramFiles(x86)%\hotspot shield\htdocs\tiles\abs_icon.png
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\a.gif
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\htdocs\r\img_new\pic_virtual_location_for_free_user.png
%ProgramFiles(x86)%\hotspot shield\bin\system.windows.interactivity.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\api-ms-win-core-datetime-l1-1-0.dll
%ProgramFiles(x86)%\hotspot shield\bin\tr\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\ar\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\pt\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\ko\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\ja\hss.client.ui.view.resources.dll
%ProgramFiles(x86)%\hotspot shield\bin\es\hss.client.ui.view.resources.dll
%PROGRAMDATA%\hotspot shield\config\startup.cfg

Sets the 'hidden' attribute to the following files

%TEMP%\~wqicrbj.tmp
%TEMP%\~rhgczub.tmp

Deletes the following files

%TEMP%\autc7d6.tmp
%WINDIR%\installer\msi123a.tmp-\setup.common.dll
%WINDIR%\installer\msi123a.tmp-\setup.actions.dll
%WINDIR%\installer\msi123a.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi123a.tmp-\customaction.config
%WINDIR%\installer\msic3bb.tmp-\wixsharp.dll
%WINDIR%\installer\msic3bb.tmp-\setup.helper.dll
%WINDIR%\installer\msic3bb.tmp-\setup.common.dll
%WINDIR%\installer\msic3bb.tmp-\setup.actions.dll
%WINDIR%\installer\msic3bb.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msic3bb.tmp-\customaction.config
%WINDIR%\installer\msibbda.tmp-\wixsharp.dll
%WINDIR%\installer\msibbda.tmp-\setup.helper.dll
%WINDIR%\installer\msibbda.tmp-\setup.common.dll
%WINDIR%\installer\msibbda.tmp-\setup.actions.dll
%WINDIR%\installer\msibbda.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msibbda.tmp-\customaction.config
%WINDIR%\installer\msiabdb.tmp-\wixsharp.dll
%WINDIR%\installer\msiabdb.tmp-\setup.helper.dll
%WINDIR%\installer\msiabdb.tmp-\setup.common.dll
%WINDIR%\installer\msiabdb.tmp-\setup.actions.dll
%WINDIR%\installer\msiabdb.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msiabdb.tmp-\customaction.config
%TEMP%\autdf08.tmp
%WINDIR%\installer\msi123a.tmp-\setup.helper.dll
%WINDIR%\installer\msi123a.tmp-\wixsharp.dll

Moves the following files

from %TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\hotspotshieldpackageid to %PROGRAMDATA%\package cache\.unverified\hotspotshieldpackageid
from %PROGRAMDATA%\package cache\.unverified\hotspotshieldpackageid to %PROGRAMDATA%\package cache\{af599c42-a2e5-4251-b7ee-4925c127fccf}v7.0.5.10668\hss-7.0.5-install-plain-773-plain.msi

Network activity

TCP

'd3#######lxv4f.cloudfront.net':443
'd3#######xjft9.cloudfront.net':443

UDP

DNS ASK d3#######lxv4f.cloudfront.net
DNS ASK d3#######xjft9.cloudfront.net

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\~wqicrbj.tmp' /S
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/dport_end" "56999" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/dport_start" "56700" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/log_append" "0" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/log_path" "%ProgramFiles(x86)%\Hotspot Shield\log\oas.log" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/log_dir" "%ProgramFiles(x86)%\Hotspot Shield\log" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/priority" "NORMAL_PRIORITY_CLASS" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/hydra_path" "%ProgramFiles(x86)%\Hotspot Shield\bin\hydra.exe" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/exe_path" "%ProgramFiles(x86)%\Hotspot Shield\bin\openvpn.exe" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/config_ext" "hvpn" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/local_addr" "127.0.0.1" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/verify_dir" "%ProgramFiles(x86)%\Hotspot Shield\log\verify" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/config_dir" "%ProgramFiles(x86)%\Hotspot Shield\config" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/installer" "HSS-7.0.5-install-plain-773-plain.exe" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/service_name" "hshld" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/ui_path" "%ProgramFiles(x86)%\Hotspot Shield\bin\hsscp.exe" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/service_path" "%ProgramFiles(x86)%\Hotspot Shield\bin\cmw_srv.exe" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/home_path" "%ProgramFiles(x86)%\Hotspot Shield\\" "config" -product hss
'%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.be\hss-7.0.5-install-plain-773-plain.exe' -q -burn.elevated BurnPipe.{F9897FAA-C131-42F9-84C8-339D6AA1C657} {4730B219-5993-4E0A-9590-2F7362B3A478} 1544
'%TEMP%\{7dc714f7-1182-41d2-88d7-5068a41b89b4}\.cr\~wqicrbj.tmp' -burn.clean.room="%TEMP%\~wqicrbj.tmp" -burn.filehandle.attached=196 -burn.filehandle.self=204 /S
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/htdocs_dir" "%ProgramFiles(x86)%\Hotspot Shield\htdocs" "config" -product hss
'%ProgramFiles(x86)%\hotspot shield\bin\hssinstaller.exe' -addcfg "startup.cfg" "/config/http_port" "895" "config" -product hss
'%TEMP%\{214ed21a-3513-46ef-b383-13203479f36f}\.be\hss-7.0.5-install-plain-773-plain.exe' -q -burn.elevated BurnPipe.{F9897FAA-C131-42F9-84C8-339D6AA1C657} {4730B219-5993-4E0A-9590-2F7362B3A478} 1544' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIABDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1158500 1 Setup.Actions!Setup.Actions.CustomActions.Disconnect
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIBBDA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1162203 5 Setup.Actions!Setup.Actions.CustomActions.ServiceExecuteCommand
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIC3BB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1164234 10 Setup.Actions!Setup.Actions.CustomActions.Sleep
'%WINDIR%\syswow64\sc.exe' config HssWd start= disabled
'%WINDIR%\syswow64\net1.exe' stop HssWd
'%WINDIR%\syswow64\sc.exe' config HssTrayService start= disabled
'%WINDIR%\syswow64\net1.exe' stop HssTrayService
'%WINDIR%\syswow64\sc.exe' config hshld start= disabled
'%WINDIR%\syswow64\net1.exe' stop hshld
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI123A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1184312 144 Setup.Actions!Setup.Actions.CustomActions.SetEpochTime
'%WINDIR%\syswow64\certutil.exe' -addstore TrustedPublisher "%ProgramFiles(x86)%\Hotspot Shield\driver\af16.cer"
'%WINDIR%\syswow64\certutil.exe' -addstore TrustedPublisher "%ProgramFiles(x86)%\Hotspot Shield\driver\af.cer"
'%WINDIR%\syswow64\certutil.exe' -addstore TrustedPublisher "%ProgramFiles(x86)%\Hotspot Shield\driver\af2.cer"

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial