SearchProtectToolbar_8e0da017ba

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

putfu.exe:2752
nsiC3.exe:840
sp-downloader.exe:1700
CltMngSvc.exe:1912
CltMngSvc.exe:1324
cltmng.exe:660
nsgBD.tmp:1656
usetup.exe:3280
cltmngui.exe:1540
rundll32.exe:2928
rundll32.exe:2880
%original file name%.exe:224
nspC7.exe:2460
nsdB5.exe:1708
nsdB5.exe:384
UpdateSoftware.exe:1580
UpdateSoftware.exe:3816

The Backdoor injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process putfu.exe:2752 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Program Files%\ProgramUpdater\Assistant.dll (264574 bytes)
%Program Files%\ProgramUpdater\AssistantSvc.dll (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tf00294823.dll (30622 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tf00294823.dll (0 bytes)

The process nsiC3.exe:840 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsjC5.tmp\inetc.dll (30 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsjC5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsjC5.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsjC5.tmp\a.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstC4.tmp (0 bytes)

The process sp-downloader.exe:1700 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nscB3.tmp (7189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\downloadstub[1] (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\MiniStubUtils.dll (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstB6.tmp (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\spstub[1].exe (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdB5.exe (11736 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\MiniStubUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inet.txt1_M1E95D34D-01FE-4869-AA16-13BE9143470C (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstB6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdB5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB2.tmp (0 bytes)

The process CltMngSvc.exe:1912 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Program Files%\SearchProtect\Main\rep\SystemRepository.dat (9 bytes)

The process cltmng.exe:660 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserSettings.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (1751 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\STG\Init_C6.tmp (0 bytes)

The process nsgBD.tmp:1656 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Program Files%\SearchProtect\UI\dialogs\Images\close-win-def.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox_checked.png (360 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgUninstall.png (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\menu-selected.png (3 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\v.png (1 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPVC64.dll (103387 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPVC32.dll (287458 bytes)
%Program Files%\SearchProtect\EULA.txt (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.html (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-onclick.png (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\gray-bg.png (2 bytes)
%Program Files%\SearchProtect\Main\bin\uninstall.exe (33747 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.css (4 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.css (5 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPVC32Loader.dll (6584 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button2.png (886 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnSilver.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\main.js (10 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox.png (378 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnClose.png (933 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPTool64.exe (50351 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\json2.min.js (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgSettings.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshC2.tmp (763 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez-def.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\defaults.js (983 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez.png (256 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\close-win-over-click.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button.png (859 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg.png (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\bin\cltmngui.exe (100378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsiC3.exe (5520 bytes)
%Program Files%\SearchProtect\UI\dialogs\style.css (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswC0.tmp (691196 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgSettingsDS.png (9 bytes)
%Program Files%\SearchProtect\Main\bin\CltMngSvc.exe (97773 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\cltmng.exe (170836 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg-uninstall.png (11 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\info-icon.png (424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\browsers32.sdb (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\button-bg.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.js (5 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button-def.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\SPDialogAPI.js (3 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings.html (8 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgNotif.png (9 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\SPtool.dll (81046 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.html (5 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Settings-icon.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg-with-logo.png (1552 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button-selected.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.js (7 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.js (7 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\menu-rollover.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.html (12 bytes)
%Program Files%\SearchProtect\Main\rep\SystemRepository.dat (2225 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\text-field.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.css (4 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox_def.png (274 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\icon-win.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\dialogUtils.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnBlue.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspC7.exe (5520 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\x.png (1 bytes)
%Program Files%\SearchProtect\Main\bin\SPTool.dll (81732 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (478 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\inetc.dll (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-default.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C6.tmp (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.css (8 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-Rollover.png (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez-selected.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\CT3309297[1] (763 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.js (11 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\defaults.js (1 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPVC64Loader.dll (8560 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nswBF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\SPtool.dll (0 bytes)

The process usetup.exe:3280 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\SoftSafe\UpdateSoftware\UpdateSoftware.exe (33792 bytes)

The process cltmngui.exe:1540 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\UI\rep\UIRepository.dat (1057 bytes)

The process %original file name%.exe:224 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_3.ini (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.exe (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\sp-downloader[1].exe (5064 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Custom.dll (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_tinCEA5.bat (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\_Setup.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Readme.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\4_3[1].txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.ico (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\8e0da017ba8021a7d587a49ead1f5c72.log (3053202 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.exe (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\2[1].txt (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_tinE12B.bat (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_2.ini (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.sp-downloader.exe (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60} (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.putfu.exe (163934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tsu926E9E8E.dll (2569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x64\regsvr32.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.ico (4 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Readme.txt (2 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.dat (14184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\4_2[1].txt (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\_Setup.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\general_logo.bmp.tmp (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.2.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.1.ini (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1[1].txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\tpq[1].exe (163934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3202_appcompat.txt (2286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\agup[1].exe (33536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\general_logo[1].bmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.usetup.exe (33536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x86\regsvr32.exe (12 bytes)
%Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\TsuDll.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Custom.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.3.ini (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\3[1].txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D29ACE87.dat (13584 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_2.ini.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons\putfu.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_tinCEA5.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.usetup.exe.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\r2.monitorbox1[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Readme.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.3.ini.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D29ACE87.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_3.ini.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.1.ini.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_tinE12B.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\_Setup.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x64 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x64\regsvr32.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons\usetup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.putfu.exe.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x86 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.sp-downloader.exe.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons\sp-downloader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\general_logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\down.224.2.ini.part (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x86\regsvr32.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Custom.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DFDE71.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tsu926E9E8E.dll (0 bytes)

The process nspC7.exe:2460 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsvC9.tmp\inetc.dll (30 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsvC9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfC8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvC9.tmp\a.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvC9.tmp\inetc.dll (0 bytes)

The process nsdB5.exe:1708 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\StubUtils.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoBE.txt (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgBB.tmp (11152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\System.dll (11 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsqBA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoBE.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\StubUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inet.txt2_M1E95D34D-01FE-4869-AA16-13BE9143470C_{BA808747-6D26-4AE9-BED0-C8ED1A8042F1} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\System.dll (0 bytes)

The process nsdB5.exe:384 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgBD.txt (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB8.tmp (11152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgBD.tmp (434424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\SPSetup[1].exe (434424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\StubUtils.dll (9320 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsgB7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\inet.txt2_M1E95D34D-01FE-4869-AA16-13BE9143470C_{35413975-D066-4445-8433-15088E18B9C2} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgBD.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\StubUtils.dll (0 bytes)

The process UpdateSoftware.exe:3816 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%WinDir%\Tasks\UpdateSoftware-S-3956077583.job (692 bytes)
%Documents and Settings%\All Users\Application Data\SoftSafe\UpdateSoftware\3956077583.ini (42494 bytes)

Registry activity

The process putfu.exe:2752 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"27ddcf6f" = "///%"
"8b9e4cbc" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 24 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c6c5dd44" = "V/////%%"
"e46c271e" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"InstallDate" = "20130815"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"340d3099" = "/P////%%"
"f0bf0bde" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"NoModify" = "1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c99a5f5c" = "///%"
"72758a5d" = "///%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"65114b36" = "Vl/l////"

[HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
"n" = "1"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"Install_Dir" = "%Program Files%\\ProgramUpdater"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"bbf88800" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"data.0" = "ylN02cK nhU8Hmnikg92tuMhLH5HfWDMiEHK1xyVZoZwltKt9LjQD4XzWA BH1aMfJJDr7ICpnik"
"data.1" = "vgP13lWKxnlmjlhabc/G7q3CGSP8lqE/0 MhsGl7d1ID1tctLxNX0FEQ2U CVCgBVWIcwhMtpybZC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"uuid" = "5684ccde-7fd252c6-a8a67a25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}]
"6a096ac0" = "%Program Files%\ProgramUpdater\Assistant.dll"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"uuid" = "5684ccde-7fd252c6-a8a67a25"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"QuietUninstallString" = "%System%\RUNDLL32.EXE C:\PROGRA~1\PROGRA~1\ASSIST~1.DLL,_uninstall /un /uq"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"3efeb33e" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c24899a6" = "MP/f/CF/Mx/l/C/////%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"Mode" = "4026531840"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"Version" = "22021985"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"dlpath" = "c:\progra~1\progra~1\assist~1.dll"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"0c230bcb" = "///%"
"7367429f" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"38583bc3" = "N//e/Ct/Vx/l/C/////%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c24899a6" = "MP/f/CF/Mx/l/C/////%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"Publisher" = "Certified Publisher"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"060df2cd" = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"UninstallString" = "%System%\RUNDLL32.EXE C:\PROGRA~1\PROGRA~1\ASSIST~1.DLL,_uninstall /un"
"DisplayName" = "ProgramUpdater 1.80"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "c:\progra~1\searchprotect\searchprotect\bin\spvc32loader.dll c:\progra~1\progra~1\assist~1.dll"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"svi" = "0"
"svpath" = "c:\progra~1\progra~1\AssistantSvc.dll"
"svn" = "ProgramUpdater"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"1c311243" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"svx" = ""

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"493c7345" = ""

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"usr.0" = "YnL46Dxztvqomjlhab"
"usr.1" = "Xu4HyM/XZTVNPRJLFH"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"587b5709" = "V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"svt" = "1408101046"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 4E EE 49 BF D2 C3 E7 32 44 F8 07 6E F1 90 31"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"370856c7" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"370856c7" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c99a5f5c" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"State" = "0"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"7367429f" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"LRTS" = "0"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"LRTS" = "0"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"d94388d2" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"date" = "1408101045"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"f0bf0bde" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"0c230bcb" = "///%"
"f2c53c49" = "UlAr/XJ/c//k////"
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"38583bc3" = "N//e/Ct/Vx/l/C/////%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"65114b36" = "Vl/l////"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"d1abcdb6" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"CategoryName" = ""

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"f1f24e29" = "Vl/l/C/////%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"340d3099" = "///%"
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}]
"n" = "1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"414bc593" = "///%"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"2d71d5ab" = "V/////%%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"51d2f2ea" = "J/Af/X6/GlAf/XD/aPAK/Y//G/Ay/YP/GPAf/B//VP/j/Cx/V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"1c311243" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"data.1" = "vgP13lWKxnlmjlhabc/G7q3CGSP8lqE/0 MhsGl7d1ID1tctLxNX0FEQ2U CVCgBVWIcwhMtpybZC"
"data.0" = "ylN02cK nhU8Hmnikg92tuMhLH5HfWDMiEHK1xyVZoZwltKt9LjQD4XzWA BH1aMfJJDr7ICpnik"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c5705860" = "Vx////%%"
"27ddcf6f" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"d94388d2" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"
"414bc593" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"iiid" = "1"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"d1abcdb6" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"a0743acc" = "N/////%%"
"a2e3b941" = "///%"
"0e93c3f3" = "///%"
"51d2f2ea" = "J/Af/X6/GlAf/XD/aPAK/Y//G/Ay/YP/GPAf/B//VP/j/Cx/V/////%%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"a2e3b941" = "///%"
"a0743acc" = "N/////%%"

"7f69fa1f" = "///%"
"fe94ce1e" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{6a096ac0}]
"NoRepair" = "1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"587b5709" = "V/////%%"
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"493c7345" = ""

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"7f69fa1f" = "///%"
"e46c271e" = "///%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"72758a5d" = "///%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"3c09c42b" = "///%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"3efeb33e" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"c5705860" = "Vx////%%"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"usr.1" = "Xu4HyM/XZTVNPRJLFH"
"usr.0" = "YnL46Dxztvqomjlhab"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"060df2cd" = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"iiid" = "1"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"bbf88800" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"date" = "1408101045"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Backdoor deletes the following registry key(s):

[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
[HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsiC3.exe:840 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjC5.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 01 BB A0 9E 60 44 47 3D D3 96 60 C7 6E B8 78"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sp-downloader.exe:1700 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjC5.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsvC9.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB9.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 C0 A6 E5 C6 4F 09 FF 84 1E C8 11 76 9B A3 E5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process CltMngSvc.exe:1912 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\SearchProtect]
"TS" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E C9 B6 7F 07 0E C9 D5 05 0C F5 AD 1E 62 7C B9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process CltMngSvc.exe:1324 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 52 C2 A6 2D F2 5A 23 12 91 29 80 C9 32 58 34"

The process cltmng.exe:660 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 FA C4 97 8B C6 1E 87 20 E6 6C F8 15 7C 6F 3F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsgBD.tmp:1656 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\SearchProtect]
"SPID" = "SP2C59908A-129D-4A5A-982C-0E0732D1907D"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"Publisher" = "Client Connect LTD"

[HKLM\SOFTWARE\SearchProtect]
"Environment" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"UninstallString" = "C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe /S"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"DisplayVersion" = "2.16.20.192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SearchProtect]
"InstallDir" = "C:\PROGRA~1\SearchProtect"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"DisplayIcon" = "C:\PROGRA~1\SearchProtect\SearchProtect\bin\cltmng.exe"
"DisplayName" = "Search Protect"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 86 40 52 20 28 53 31 2E 17 00 D7 03 FA 2F A3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The Backdoor disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallCleanUp"

The process usetup.exe:3280 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 7E 08 7C 9B 5F D8 C4 30 A3 3A 5A F6 6C 30 4E"

The process cltmngui.exe:1540 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC E8 89 88 FB AC 03 A3 DD D7 49 AB B8 F0 F4 24"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process rundll32.exe:2928 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 09 7C B0 A7 38 3C 86 F9 F3 ED 02 0D EA 8C AC"

The process rundll32.exe:2880 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 36 F5 F5 0F 6F 45 6E 3D 6A AD 04 45 5B 67 33"

The process %original file name%.exe:224 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ReceiveTimeout" = "600000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"Language" = "1033"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjC5.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsvC9.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB9.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Tsu926E9E8E.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons]
"sp-downloader.exe" = "Search Protect"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"VersionMinor" = "0"

"QuietUninstallString" = "C:\DOCUME~1\ALLUSE~1\APPLIC~1\INSTAL~1\{0FD22~1\Setup.exe /remove /q"
"VersionMajor" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"Version" = "16777216"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"EstimatedSize" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Fonts" = "%WinDir%\Fonts"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 15 F4 6E D5 72 C2 9C 4C FD C6 C5 68 B4 09 31"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"UninstallString" = "C:\DOCUME~1\ALLUSE~1\APPLIC~1\INSTAL~1\{0FD22~1\Setup.exe /remove /q0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"TSAware" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Addons]
"usetup.exe" = "usetup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\83ef4af0-d010-4d84-b5c5-54b2fb84b01c]
"TizPath" = "c:\%original file name%.exe"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process nspC7.exe:2460 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjC5.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsvC9.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 23 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 0B 42 CF 41 7E 03 3F 5E 86 35 B1 ED 5D 31 56"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsdB5.exe:1708 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 04 52 FE A7 64 70 56 20 25 C4 5A E0 3C 6F B1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsdB5.exe:384 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslBC.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjC5.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsvC9.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB9.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 59 9C E7 E7 79 0E 63 52 0B ED 00 89 A1 8B FC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process UpdateSoftware.exe:1580 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"1c311243" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"
"060df2cd" = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
"0dc3ee96" = "/P////%%"
"7367429f" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"2d71d5ab" = "V/////%%"
"7f69fa1f" = "///%"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"493c7345" = ""

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"587b5709" = "V/////%%"
"340d3099" = "/P////%%"
"72758a5d" = "///%"
"6185d035" = "VP/h/CP/V//l////"
"0e93c3f3" = "///%"
"51d2f2ea" = "J/Af/X6/GlAf/XD/aPAK/Y//G/Ay/YP/GPAf/B//VP/j/Cx/V/////%%"
"c24899a6" = "MP/f/CF/Mx/l/C/////%"
"d1abcdb6" = "///%"
"37b7a6d8" = "UlAr/XJ/c//k////"
"0c230bcb" = "///%"
"d94388d2" = "GxAy/YV/c/At/XD/c/Ay/XF/cPAj/YV/FlAy/X2/UxAp/X2/GxAk////"
"f0bf0bde" = "///%"
"65114b36" = "Vl/l////"
"f1f24e29" = "Vl/l/C/////%"
"a0743acc" = "N/////%%"
"c6c5dd44" = "V/////%%"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0]
"iiid" = "1"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"3efeb33e" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"3c09c42b" = "///%"
"c5705860" = "Vx////%%"
"c99a5f5c" = "///%"
"414bc593" = "///%"
"a2e3b941" = "///%"
"e46c271e" = "///%"
"fe94ce1e" = "V/////%%"
"1520c6f1" = "V/////%%"
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 6A D3 33 07 E7 4C AC 33 5C A4 6A 29 73 99 C7"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\00000000]
"370856c7" = "p01e07x0qx1A06h0n01 06l0nU1Z06t0mU1g0640nl0S06h0nl1A06E0, p01e07x0qx1D06I0mU1O0640n01Y06t0ml1N06b0qx1S02I0ox1S06q0nU0%, p01e07x0qx1N06t0nl1h06O0jx1P06Y0mU1g0640nl0S06h0nl1A06E0, p01T07m0nl1Y06E0qx1h06x0qx1O0640mU1g0640nl0S06h0nl1A06E0"

[HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_6a096ac0\eae10f9d]
"27ddcf6f" = "///%"
"8b9e4cbc" = "V/////%%"
"bbf88800" = "///%"
"38583bc3" = "N//e/Ct/Vx/l/C/////%"

The process UpdateSoftware.exe:3816 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 jyYwQburpniZRRB5FiXXl0Nh4RV" = "NP6yu5 vmsLWrtvqomdnZfXgratpYVnb"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"URLUpdateInfo" = ""
"URLInfoAbout" = ""

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 iI0lv89/XZTpmaWCAW6XiF/xIowoplYxrEc" = "NP6yu5 op/1ESUMOQIiA/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"Publisher" = "PremiumSoft"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 rK2YdOCDWYSo sSZJb0LFNMK7umzJ4f" = "NP6yu5 o4IdosRJLFHmfwN6K"
"NP6yu5 obHhU6789/Xu3lMQKQBU9v0o8l1 pwHGQ7a" = "NP6yu5 ire7AFHwysu7daGH/1I 8/fYQTHvbDbfbFpsZR9hg1ZLTwQJfCgwjG"
"NP6yu5 jnTHsfABCDWtWkUM/W1aPBtS1 VQW3XAfac" = "NP6yu5 su8YtQ34567VnKOTlN"
"NP6yu5 t4SMY89/XZTo241UBcL1FgCdQgO" = "NP6yu5 jnxjzOdefABNqu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"SilentUninstall" = "c:\documents and settings\all users\application data\softsafe\updatesoftware\updatesoftware.exe /uninstall"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 oRN6utIKEG digPng1ySOBlAVHvZrTks5X3JZ0jUs" = "NP6yu5 o4IdosRJLFHmfwN6K"
"NP6yu5 t p YmhabcdJfHSAepXR5o1j1c DKl8GWf2QPTqLd" = "NP6yu5 v S3HjlhabcDHyP897ocAuGqJgsg5"
"NP6yu5 qnt FxztvqoDfBtS/GCPHJVoOIo2SDnPtKi" = "NP6yu5 yZKZjefABCDz76N9UmHe0p0kgH5NGRfwxzCZGcCt9/G/oGfA6jw"
"NP6yu5 kq14RlhabcdIjFSyg16YzyLsH" = "NP6yu5 jWjbxOabcdeYHzRJ8BJsKJZOV"
"NP6yu5 qCEj2JrpnikTXYRb/hjk8pv2i7" = "NP6yu5 ire7AFHwysu7daGH/1I 8/fYQTHvbDbfbFpsZR9hg1ZLTwQJfCgwjG"
"NP6yu5 mGMVNpnikg0UES4we2P15TB9y" = "NP6yu5 zbMgbIcdefAUN"
"NP6yu5 kzHwZuJLFHw5Fr3FSOzPpISE/F" = "NP6yu5 vnNnZzG xztBe7qNMhrU5nv7p2jg3MSoGKR2AOifGjaisEzPiKveJre7eC2osjAxko/vUyvZtN4IYuES3zz9TinpNYuYzUZrmzq09xRJjuTq5AlcMd3b9ymQA4IBVY581FGF0U3Y qvoIHd3yitOyzlhhUG9isJtU cLS4On UnxKakKxqiq7s2UoJE3nd3krWq 9v5e1lcOEFzZuwR0C5G0Buk1ekwXnca4/GyWLQ0RKA9/gnyRwN doQEiqxnReBKT7HtpltL5cigNEXkGeb6N3PGb6 KyXobYwYER8wYBbGekIO59ZF2 v3RA rA9WcH4txlPPE9YV8gwJ1qDAFwj/PZPKgcu2OOVdZjePKZtQKwHQzU0RtDHELJESORhEr2Tb bhyJwiujYtSlzFVmWr9noi3dhI8YGcrw XL7KqDHuJCUbSKlV3Y4qrbtWHvv8m5nZ93LHYjJcoiD3QD8ZTuqjowIP0PH1FyNY3/n"
"NP6yu5 jJE/mnBCDWYvA42sczUv9SClfrqvZXt8sBARO" = "NP6yu5 vmsLWrtvqomdnZfXgratpYVnb"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"NoModify" = "1"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 mA7A/0RJLFH3oCqCND9QOs7c7LJLxGmTX4Y5fn0nd" = "NP6yu5 xztvqomjlha"
"NP6yu5 zUPS3jlhabcQDMNIScd6AO3aDxmTq1WIaX6" = "NP6yu5 tQ3dtOHwysu7dAPo9rWzs6Cz73val5GwlYqnEmAXyKRiEzz 0sbZtS5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"DisplayName" = "UpdateSoftware"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 tJp3sbqomjlSvJfgkDPgofAaSAq8LeS0XEI" = "NP6yu5 nsOVqgsurpn3luw"
"NP6yu5 imD09G789/XrRUo/jOxMoD5p8s7z6" = "NP6yu5 owmZMztvqom44"
"NP6yu5 y9R/xAztvqoWETd7yHx7kCFYzD24sLA" = "NP6yu5 xztvqomjlha"
"NP6yu5 rOHR67habcdI6oQitBZylEDlKv" = "NP6yu5 ookVA701234YHM8"
"NP6yu5 pNrKTFbcdefEjL8Z1TlnENCpBpb" = "NP6yu5 rBInjOlhabcD1FUrNUWvK5"
"NP6yu5 m493B1JLFHwfSLP0cq" = "NP6yu5 rBInjOlhabcD1FUrNUWvK5"
"NP6yu5 t5w/eBhabcdLg7/sFSAaTxRvG" = "NP6yu5 xvTqlqdefABK 80Gq2mWBC1o0 "
"NP6yu5 qAAIJrpnikgVSUoLaz3mK8u RgKbxPY" = "NP6yu5 ms6Kogvqomje5FgkwM"
"NP6yu5 o/JAuurpnikZzc72iod641QVSkWTqJSu5zR" = "NP6yu5 rk50XvKEG xeKLvesJcI/uDaKRkMWR2hnutqmBtZdkaLX2fgHL"
"NP6yu5 q2cpRx789/XueIe5iLgmR36Hi9ZR5HNZs2A" = "NP6yu5 p2g4ahLFHwykW"
"NP6yu5 mPpwLQDWYSUoj8v7lBa0 8W0MSmWN4ClWM7" = "NP6yu5 mAzKd789/XZzLMPPGMuVLt9zIJASWw"
"NP6yu5 me6uTVNPRJL13Jfl4Pkq3 KZkkBGDuDhpPPquV" = "NP6yu5 owmZMztvqom44"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"CategoryName" = "Apps"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 sFynDebcdef tMD" = "NP6yu5 zbMgbIcdefAUN"
"NP6yu5 vGPjjAfABCDtsHMzvqSfT7E4si" = "NP6yu5 nsOVqgsurpn3luw"
"NP6yu5 u2C5SlhabcdKYXGD2X5Dtp " = "NP6yu5 n6OXwBkg012Ddmp9hN1dZbdGi"
"NP6yu5 yEFhrM xztvBTqybYrHCKZLQDEDd77yDa71" = "NP6yu5 nWYONZWYSUMmKdWHSyBsxoIXlq8L0acxfPYSvuyukjdQWYOTbm8kHsQ"
"NP6yu5 xyxzUr xztv8XRDd4dOlw/ 0eLrMM" = "NP6yu5 p/RcQikg012CPtvY0JqomLb"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"NoRepair" = "1"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 s2TbxEefABCxJ0DAXr /fsJdEdZsSHr HV" = "NP6yu5 jWjbxOabcdeYHzRJ8BJsKJZOV"
"NP6yu5 ow1rR56789/ue1sByvUf4kVuix" = "NP6yu5 p2g4ahLFHwykW"
"NP6yu5 jxu9x/ztvqoWwAvzzG1eDHhjPa" = "NP6yu5 mAzKd789/XZzLMPPGMuVLt9zIJASWw"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"InstallDate" = "20130815"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 q83XdcabcdeK18vAC0H9NVFErZY89qziqz" = "NP6yu5 xvTqlqdefABK 80Gq2mWBC1o0 "
"NP6yu5 xegqyZTVNPRhap40RL5nzk9RVF fIgeuX" = "NP6yu5 ouLGsR/XZTVHZg6"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 7C 54 1B 91 E4 06 75 06 27 D7 D6 BD DA 95 07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"_In" = "20140815"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 upBrs456789yYTFdDrzVA0PJHl5GUN4cRRU6I0 /b" = "NP6yu5 ms6Kogvqomje5FgkwM"
"NP6yu5 mGooxrikg01VravP7V/5b68FyY" = "NP6yu5 su8YtQ34567VnKOTlN"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"DisplayIcon" = "C:\Windows\System32\msiexec.exe"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 t3BD56789/Xu4TF4qCfDCBTHm9BO81oA/UPCl" = "NP6yu5 jnxjzOdefABNqu"
"NP6yu5 vbNHYCDWYSUoiK7bPU/LiTlOXXB/Y/8ZsgUeDPvDrC" = "NP6yu5 ouLGsR/XZTVHZg6"
"NP6yu5 sH9 Y xztvq/XYWHIi jTIOMPd" = "NP6yu5 nWYONZWYSUMmKdWHSyBsxoIXlq8L0acxfPYSvuyukjdQWYOTbm8kHsQ"
"NP6yu5 iqFGhLqomjlSrvHfNHJ3oZIgyJwy44WgZ8t" = "NP6yu5 vnNnZzG xztBe7qNMhrU5nv7p2jg3MSoGKR2AOifGjaisEzPiKveJre7eC2osjAxko/vUyvZtN4IYuES3zz9TinpNYuYzUZrmzq09xRJjuTq5AlcMd3b9ymQA4IBVY581FGF0U3Y qvoIHd3yitOyzlhhUG9isJtU cLS4On UnxKakKxqiq7s2UoJE3nd3krWq 9v5e1lcOEFzZuwR0C5G0Buk1ekwXnca4/GyWLQ0RKA9/gnyRwN doQEiqxnReBKT7HtpltL5cigNEXkGeb6N3PGb6 KyXobYwYER8wYBbGekIO59ZF2 v3RA rA9WcH4txlPPE9YV8gwJ1qDAFwj/PZPKgcu2OOVdZjePKZtQKwHQzU0RtDHELJESORhEr2Tb bhyJwiujYtSlzFVmWr9noi3dhI8YGcrw XL7KqDHuJCUbSKlV3Y4qrbtWHvv8m5nZ93LHYjJcoiD3QD8ZTuqjowIP0PH1FyNY3/n"
"NP6yu5 jO7cksRJLFHdItgO4" = "NP6yu5 ookVA701234YHM8"
"NP6yu5 kMSXeBMOQIKhE69m1QE674UDEx" = "NP6yu5 op/1ESUMOQIiA/"
"NP6yu5 qwDMhUjlhabRi95gdx9wB Kt8h" = "NP6yu5 rk50XvKEG xeKLvesJcI/uDaKRkMWR2hnutqmBtZdkaLX2fgHL"
"NP6yu5 s/N9q2LFHwy5Ge3vWafDDyM0XgIXL/SocfUpBEc2iz" = "NP6yu5 xKYF 812345Z1"
"NP6yu5 oFUvMDbcdefHBbxrMluGJ9Aygj" = "NP6yu5 yZKZjefABCDz76N9UmHe0p0kgH5NGRfwxzCZGcCt9/G/oGfA6jw"
"NP6yu5 qmagWavqomjYke3rg3RaIWgtRR6ly542b" = "NP6yu5 n6OXwBkg012Ddmp9hN1dZbdGi"
"NP6yu5 oxTCwROQIKEbfoQmXOVq3pyCV" = "NP6yu5 zbMgbIcdefAUN"
"NP6yu5 u4W7I3FHwysfpPWVEc640Vgj7vuI5FRvR" = "NP6yu5 xKYF 812345Z1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"UninstallString" = "c:\documents and settings\all users\application data\softsafe\updatesoftware\updatesoftware.exe /uninstall"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 uGnmtBCDWYSqb6jM/jZxaHmJs4bb/qRin 8" = "NP6yu5 mbJv4NCDWYSFDYGY/idAu1r"
"NP6yu5 xh2uW4Hwysu7Ssr8oWZx2xW2hDd4djxqbX" = "NP6yu5 zbMgbIcdefAUN"
"NP6yu5 r 8G2h34567HEDrcOMl 7 u93c" = "NP6yu5 mbJv4NCDWYSFDYGY/idAu1r"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-3956077583]
"DisplayVersion" = "4.2.0.1452"

[HKLM\SOFTWARE\UpdateSoftware\3956077583\NP6yu5 tnZZH0OQIKE1/gD3hJMqT/]
"NP6yu5 xGCT2oqomjlV2gRnCoLMWn7nyn" = "NP6yu5 tQ3dtOHwysu7dAPo9rWzs6Cz73val5GwlYqnEmAXyKRiEzz 0sbZtS5"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   putfu.exe:2752
   nsiC3.exe:840
   sp-downloader.exe:1700
   CltMngSvc.exe:1912
   CltMngSvc.exe:1324
   cltmng.exe:660
   nsgBD.tmp:1656
   usetup.exe:3280
   cltmngui.exe:1540
   rundll32.exe:2928
   rundll32.exe:2880
   %original file name%.exe:224
   nspC7.exe:2460
   nsdB5.exe:1708
   nsdB5.exe:384
   UpdateSoftware.exe:1580
   UpdateSoftware.exe:3816

2. Delete the original Backdoor file.
   
3. Delete or disinfect the following files created/modified by the Backdoor:

   %Program Files%\ProgramUpdater\Assistant.dll (264574 bytes)
   %Program Files%\ProgramUpdater\AssistantSvc.dll (174 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tf00294823.dll (30622 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsjC5.tmp\inetc.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nscB3.tmp (7189 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\downloadstub[1] (52 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\MiniStubUtils.dll (7192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nstB6.tmp (52 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\spstub[1].exe (11736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsdB5.exe (11736 bytes)
   %Program Files%\SearchProtect\Main\rep\SystemRepository.dat (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserSettings.dat (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (1751 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\close-win-def.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox_checked.png (360 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgUninstall.png (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\menu-selected.png (3 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\v.png (1 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPVC64.dll (103387 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPVC32.dll (287458 bytes)
   %Program Files%\SearchProtect\EULA.txt (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.html (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-onclick.png (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\gray-bg.png (2 bytes)
   %Program Files%\SearchProtect\Main\bin\uninstall.exe (33747 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.css (4 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.css (5 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPVC32Loader.dll (6584 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button2.png (886 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnSilver.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\main.js (10 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox.png (378 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnClose.png (933 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPTool64.exe (50351 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\json2.min.js (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgSettings.png (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nshC2.tmp (763 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez-def.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\defaults.js (983 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez.png (256 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\close-win-over-click.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button.png (859 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg.png (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\bin\cltmngui.exe (100378 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsiC3.exe (5520 bytes)
   %Program Files%\SearchProtect\UI\dialogs\style.css (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nswC0.tmp (691196 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgSettingsDS.png (9 bytes)
   %Program Files%\SearchProtect\Main\bin\CltMngSvc.exe (97773 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\cltmng.exe (170836 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg-uninstall.png (11 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\info-icon.png (424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\browsers32.sdb (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\button-bg.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.js (5 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button-def.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\SPDialogAPI.js (3 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings.html (8 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgNotif.png (9 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.html (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\SPtool.dll (81046 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.html (5 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Settings-icon.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg-with-logo.png (1552 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button-selected.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.js (7 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.js (7 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\menu-rollover.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.html (12 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\text-field.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.css (4 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox_def.png (274 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\icon-win.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\dialogUtils.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnBlue.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspC7.exe (5520 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\x.png (1 bytes)
   %Program Files%\SearchProtect\Main\bin\SPTool.dll (81732 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsmC1.tmp\inetc.dll (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-default.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\C6.tmp (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.css (8 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-Rollover.png (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez-selected.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\CT3309297[1] (763 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.js (11 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\defaults.js (1 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPVC64Loader.dll (8560 bytes)
   %Documents and Settings%\All Users\Application Data\SoftSafe\UpdateSoftware\UpdateSoftware.exe (33792 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\UI\rep\UIRepository.dat (1057 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_3.ini (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.exe (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\sp-downloader[1].exe (5064 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Custom.dll (61 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_tinCEA5.bat (84 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\_Setup.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Readme.txt (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\4_3[1].txt (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.ico (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\8e0da017ba8021a7d587a49ead1f5c72.log (3053202 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.exe (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\2[1].txt (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_tinE12B.bat (88 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.4_2.ini (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.sp-downloader.exe (5064 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.putfu.exe (163934 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tsu926E9E8E.dll (2569 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x64\regsvr32.exe (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.ico (4 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Readme.txt (2 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Setup.dat (14184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\4_2[1].txt (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\_Setup.dll (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\general_logo.bmp.tmp (808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.2.ini (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.1.ini (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\1[1].txt (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\tpq[1].exe (163934 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3202_appcompat.txt (2286 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\agup[1].exe (33536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\general_logo[1].bmp (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.usetup.exe (33536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\x86\regsvr32.exe (12 bytes)
   %Documents and Settings%\All Users\Application Data\InstallMate\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\TsuDll.dll (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{0FD22F96-C7D8-47FB-A510-8FFAD4310D60}\Custom.dll (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\down.224.3.ini (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\3[1].txt (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\D29ACE87.dat (13584 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvC9.tmp\inetc.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\StubUtils.dll (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsoBE.txt (79 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsgBB.tmp (11152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslBC.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsgBD.txt (71 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB8.tmp (11152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsgBD.tmp (434424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\SPSetup[1].exe (434424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslB9.tmp\StubUtils.dll (9320 bytes)
   %WinDir%\Tasks\UpdateSoftware-S-3956077583.job (692 bytes)
   %Documents and Settings%\All Users\Application Data\SoftSafe\UpdateSoftware\3956077583.ini (42494 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

Static Analysis

VersionInfo

Company Name: SoftSafe
Product Name: SoftSafe
Product Version: 1.0.0.1
Legal Copyright: Copyright (c) 2012 SoftSafe
Legal Trademarks:
Original Filename: TSULoader.exe
Internal Name: TSULoader
File Version: 2013.3.24.1715
File Description: Installer for SoftSafe
Comments: WinNT (x86) Unicode Lib Rel
Language: Language Neutral

Company Name: SoftSafeProduct Name: SoftSafeProduct Version: 1.0.0.1Legal Copyright: Copyright (c) 2012 SoftSafeLegal Trademarks: Original Filename: TSULoader.exeInternal Name: TSULoaderFile Version: 2013.3.24.1715File Description: Installer for SoftSafeComments: WinNT (x86) Unicode Lib RelLanguage: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2026
0b01d1d6e64db0f42e95f7673aa20c8d
ee5a918e0071b8ddfc5e1459507cdb0c
90d174bf957ec052ffac0a3ff0975a87
59de7fbdc6af7d28cfde8dbc60eaf9d9
6223fd901c30fb54ecba1704fa2da545
bbd5163a81c9f5c760169b782223bb41
b69b50306ec6bd331c6344afd43a7318
079c002b726e9367df3746ab6562fe23
bed6c0b1480c33d78178968c26206259
8a0a68d16fec55ea3c07ea6de4500b8f
53d570578307032d3f921ec2ba3cccf0
278c31aac865261c6efdfad5c44b3abf
3b71a2f9d418d95636623890887ec4e5
47adc2ef8540d44b6901860fd3c98b25
cafac5ed92504095a31aaf116d898c88
f183ec1d34fbe1a400c1e1919e5af1b6
9bc0019bc805331ba01ce31ed7e96b75
ca995c0ac4096a501c869ed0577f855f
a2bd18fdcff95c6aed5854f20d593748
fc8da1d6dce390b557ec6d4046dc2a8a
0c7d6124a15abd2f81dada99607a3813
0b07fde626af7b707befb5bce2e7c855
6b86612b8eb8359085ed6eb76e919fce
acd146488fc046a0a14fff05ece8d7d6
63057b7b765029e34aaacd56a1705c81
e7060de701746e204db1379bf6e5091c

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

<font color="red">POST / HTTP/1.0<br>

Content-Type: application/json<br>

Accept: */*<br>

Host: sp-usage.databssint.com<br>

Content-Length: 417<br>

Connection: Keep-Alive<br>

Pragma: no-cache<br>

<br>

{"SP_ID":"SP2C59908A-129D-4A5A-982C-0E0732D1907D","Experiment":"","Variant":"","oslocale":"","environment":"","OS_version":"5.1","OS_name":"Microsoft Windows XP","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","sequence_timestamp":"1408101022108","SP_version":"2.16.20.192","brand":"SP","action_type":"driver_first_enabled","result":"success","failure_reason":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Access-Control-Allow-Methods: GET,POST,HEAD,OPTIONS,PUT<br>

Access-Control-Allow-Origin: *<br>

Date: Fri, 15 Aug 2014 16:09:33 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

<font color="red">GET /UP/settings/?ctid=CT3309297&UM=&c=CA&DUM=2 HTTP/1.1<br>

User-Agent: SearchProtect;2.16.20.192;Microsoft Windows XP;SP2C59908A-129D-4A5A-982C-0E0732D1907D<br>

Accept: */*<br>

Host: c.api.seccint.com<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: application/json; charset=utf-8<br>

Server: Microsoft-IIS/7.5<br>

X-AspNetMvc-Version: 3.0<br>

X-AspNet-Version: 4.0.30319<br>

X-Powered-By: ASP.NET<br>

Content-Length: 4227<br>

Cache-Control: private, max-age=3600<br>

Expires: Fri, 15 Aug 2014 17:09:38 GMT<br>

Date: Fri, 15 Aug 2014 16:09:38 GMT<br>

<<< skipped >>>

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/json<br>

Accept: */*<br>

User-Agent: SearchProtect;2.16.20.192;Microsoft Windows XP;SP2C59908A-129D-4A5A-982C-0E0732D1907D<br>

Host: sp-alive-msg.databssint.com<br>

Content-Length: 461<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"SP_ID":"SP2C59908A-129D-4A5A-982C-0E0732D1907D","SP_version":"2.16.20.192","OS_name":"Microsoft Windows XP","OS_version":"5.1","install_date":"20140815","environment":"","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","Experiment":"","Variant":"","driver_enabled":"false","action_type":"alive","type":"","brand":"SP","carrier_ID":"CT3309297","browser":"InternetExplorer","browser_version":"6.0.2900.5512"}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:37 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: orbtr-installer.databssint.com<br>

Content-Length: 707<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"orbtr_Stub_Init", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false -orbiter", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "ORBTR", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1"}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:17 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></font>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: orbtr-installer.databssint.com<br>

Content-Length: 907<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"orbtr_Stub_DownloadComplete", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false -orbiter", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "ORBTR", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0","result":"success","reason":"50" , "log":"10#", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1", "Installer_download_time_sec":"1", "Installer_url":"hXXp://spms-storage.spccint.com/Installer/0.0.0.0/OrbiterInstaller.exe", "ExtraData":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:20 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></font>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: orbtr-installer.databssint.com<br>

Content-Length: 803<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"orbtr_Stub_Complete", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false -orbiter", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "ORBTR", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0","result":"success","reason":"50" , "log":"10#16#", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1", "Installer_time_sec":"1", "ExtraData":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:23 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

<font color="red">GET /addons/dfndr/180/tpq.exe HTTP/1.1<br>

Accept: */*<br>

User-Agent: TixDll<br>

Host: i1.installbox1.info<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: openresty<br>

Date: Fri, 15 Aug 2014 16:09:44 GMT<br>

Content-Type: application/octet-stream<br>

Content-Length: 4983808<br>

Last-Modified: Wed, 30 Jul 2014 00:07:02 GMT<br>

Connection: close<br>

ETag: "53d83726-4c0c00"<br>

<<< skipped >>>

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 968<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"install_start","SP_ID":"SP2C59908A-129D-4A5A-982C-0E0732D1907D","SP_version":"2.16.20.192","OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)","OS_version":"5.1","browser":"InternetExplorer","browser_version":"6.0.2900.5512","carrier_type":"ctid","carrier_ID":"CT3309297","carrier_version":"","carrier_userid":"","carrier_UM":"","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","hp_takeover":"true","other_takeover":"true","environment":"","sequence_timestamp":"1408101016796","profile_number":"1","user_number":"1", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "download_length": 3906, "install_type": "install", "result": "SP_RESULT", "reason": "SP_FAIL_REASON","v_env_tests":"V_ENV_TESTS_ALIAS","v_env_codes":"V_ENV_CODES_ALIAS","channel_id": "", "brand": "SP" , "previous_brand":"", "brand_install_type":"","extra_info":"","Experiment":"","Variant":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:28 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

<font color="red">GET /ip/?client=sp HTTP/1.1<br>

User-Agent: SearchProtect;2.16.20.192;Microsoft Windows XP;SP2C59908A-129D-4A5A-982C-0E0732D1907D<br>

Accept: */*<br>

Host: sp-ip2location.spccint.com<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Cache-Control: private<br>

Content-Length: 167<br>

Content-Type: application/json; charset=text/plain<br>

Server: Microsoft-IIS/7.5<br>

X-AspNet-Version: 4.0.30319<br>

X-Powered-By: ASP.NET<br>

Date: Fri, 15 Aug 2014 16:08:08 GMT<br><pre>{"Location":{"City":"MONTREAL","Country":"CANADA","CountryCode":"CA","<br>IP":""%local server IP%"","Latitude":45.50884,"Longitude":-73.58781,"Region"<br>:"QUEBEC"},"Language":"en"}..</pre></font><br><br

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 689<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"Stub_Init", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "SP", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1"}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:11 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></font>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 886<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"Stub_DownloadComplete", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "SP", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0","result":"success","reason":"0" , "log":"10#6-0#", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1", "Installer_download_time_sec":"4", "Installer_url":"hXXp://sp-storage.spccinta.com/Installer/2.16.20.192/SPSetup.exe", "ExtraData":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:18 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></font>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 794<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"Stub_Complete", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true -sessionid=M1E95D34D-01FE-4869-AA16-13BE9143470C -downloadlength=1093 -EXT_ISID=false", "download_length": "1093", "carrier_ID": "CT3309297", "carrier_type": "ctid", "carrier_version": "DEFAULT", "brand": "SP", "EXT_ISID":"false","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","installer_version":"2.4.3.0","result":"success","reason":"0" , "log":"10#6-0#8#9-0-0#", "OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)", "OS_version":"5.1", "Installer_time_sec":"23", "ExtraData":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:42 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

<font color="red">GET /Installer/2.16.20.192/SPSetup.exe HTTP/1.1<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-storage.spccinta.com<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Last-Modified: Fri, 15 Aug 2014 18:49:18 GMT<br>

Accept-Ranges: bytes<br>

ETag: "30fa0875de550a8d5c8d3bc251a75073"<br>

Server: Microsoft-IIS/7.5<br>

X-Powered-By: ASP.NET<br>

Content-Length: 6837632<br>

Date: Fri, 15 Aug 2014 16:09:13 GMT<br>

<<< skipped >>>

<font color="red">GET /get/?data=P/5VPunecjjtVl2XZT3pNPi74PImCtFB6hjJgTO4z7S5cbJwJFDhcNcDQGkX1fDa5Vy6HonzQcuuI39XGeo7ncmyCc0hl3lfGDomndl7srEdmClBZxzsWa7m7a5uiLdFlU7sfX733FbAWSCuiJbfOTvsv4Auo2u063ooFZG2hJ9neHGVokQh84nkyeoHowmgph9JOvnDL8nZ0IC9+hBB7MIUQ/7HokDjhUPbXapp89QO9TMhOv1Q7z4MKfkFkrjTI3T302H+u4k0KfVcefYYJZNWIYpYt0dJ+ShM4hMIugZsZvBf02BLPPxvYbtDSmYfrkh6BgXAMpyjspBMymUvQbKx/qhXXnsM/Ghn02+l/eVOpDkXBCmEfjZc7MWLxLjLCjProPOBQ4+U7P08CH/PD2pLzc6a+kdGRbLj3082peSz342AP+KDZ3rWMK6//d3jGUPxjFmUDjd4HAYnUOiQzHrUQk4enOo78UHu0w2hYGFaeSkg6z&version=4 HTTP/1.1<br>

Accept: */*<br>

User-Agent: win32<br>

Host: datadownloadscan.info<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: ngx_openresty<br>

Date: Fri, 15 Aug 2014 16:11:44 GMT<br>

Content-Length: 0<br>

Connection: close<br><pre></pre></font><br><br

<font color="red">GET /stub/spstub.exe HTTP/1.1<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-storage.spccinta.com<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Last-Modified: Fri, 15 Aug 2014 19:08:13 GMT<br>

Accept-Ranges: bytes<br>

ETag: "8089503af264c1568a46208aea546eff"<br>

Server: Microsoft-IIS/7.5<br>

X-Powered-By: ASP.NET<br>

Content-Length: 177352<br>

Date: Fri, 15 Aug 2014 16:09:09 GMT<br>

<<< skipped >>>

<font color="red">GET /download/CarrierId/CT3309297/CarrierVersion/DEFAULT/CarrierType/ctid/Brand/SP HTTP/1.1<br>

Accept: application/sp-download-v2<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-download.spccint.com<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Cache-Control: no-cache, no-store<br>

Pragma: no-cache<br>

Content-Type: application/json; charset=utf-8<br>

Expires: -1<br>

Server: Microsoft-IIS/7.5<br>

X-AspNet-Version: 4.0.30319<br>

X-Powered-By: ASP.NET<br>

Date: Fri, 15 Aug 2014 16:07:44 GMT<br>

Content-Length: 71<br><pre>"http:\/\/sp-storage.spccinta.com\/Installer\/2.16.20.192\/SPSetup.exe<br>"..</pre></font><br><br

<font color="red">GET /download/CarrierId/CT3309297/CarrierVersion/DEFAULT/CarrierType/ctid/Brand/SP HTTP/1.1<br>

Accept: application/sp-download-v2<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: spms-download.spccint.com<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Cache-Control: no-cache, no-store<br>

Pragma: no-cache<br>

Content-Length: 79<br>

Content-Type: application/json; charset=utf-8<br>

Expires: -1<br>

Server: Microsoft-IIS/7.5<br>

X-AspNet-Version: 4.0.30319<br>

X-Powered-By: ASP.NET<br>

Date: Fri, 15 Aug 2014 16:07:49 GMT<br><pre>"http:\/\/spms-storage.spccint.com\/Installer\/0.0.0.0\/OrbiterInstall<br>er.exe 1"..</pre></font><br><br

<font color="red">GET /?step_id=4_3&installer_id=690071314&publisher_id=388&source_id=0&page_id=0&affiliate_id=1_exe&country_code=US&locale=EN&browser_id=4&download_id=3416576962&external_id=0&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&installer_file_name=setup&uuid=* HTTP/1.1<br>

Accept: */*<br>

User-Agent: TixDll<br>

Host: c1.installbox1.info<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: openresty<br>

Date: Fri, 15 Aug 2014 16:10:01 GMT<br>

Content-Type: text/html<br>

Content-Length: 6884<br>

Connection: close<br>

<<< skipped >>>

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 1079<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"install_completed","SP_ID":"SP2C59908A-129D-4A5A-982C-0E0732D1907D","SP_version":"2.16.20.192","OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)","OS_version":"5.1","browser":"InternetExplorer","browser_version":"6.0.2900.5512","carrier_type":"ctid","carrier_ID":"CT3309297","carrier_version":"","carrier_userid":"","carrier_UM":"","machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG","hp_takeover":"true","other_takeover":"true","environment":"","sequence_timestamp":"1408101030530","profile_number":"1","user_number":"1", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C", "download_length": 3906, "install_type": "install", "result": "success", "reason": "0","v_env_tests":{"10_ProcessesExists":"0","10_ModuleInjected":"0","10_FakeSPServiceParent":"0","12_ProcessesExists":"0","12_StatusKeyExists":"0"},"v_env_codes":{"10":"0","12":"0"},"channel_id": "", "brand": "SP" , "previous_brand":"", "brand_install_type":"cleanmachine","extra_info":"","Experiment":"","Variant":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:42 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre>HTTP/1.1 202 Accepted..Date: Fri, 15 Aug 2014 16:09:42 GMT..P3P: CP="N<br>OI ADM DEV COM NAV OUR STP"..Server: Apache-Coyote/1.1..Content-Length<br>: 0..Connection: keep-alive..</pre></font><br><br

<font color="red">GET /?step_id=4_2&installer_id=690071314&publisher_id=388&source_id=0&page_id=0&affiliate_id=1_exe&country_code=US&locale=EN&browser_id=4&download_id=3416576962&external_id=0&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&session_id=4193620160&hardware_id=1419924024&installer_file_name=setup&uuid=* HTTP/1.1<br>

Accept: */*<br>

User-Agent: TixDll<br>

Host: c1.installbox1.info<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: openresty<br>

Date: Fri, 15 Aug 2014 16:09:44 GMT<br>

Content-Type: text/html<br>

Content-Length: 9094<br>

Connection: close<br>

<<< skipped >>>

<font color="red">GET /spinstallersettings/2.16.20.192/test/ABTEST_SETTINGS_ID/carrierId/CT3309297 HTTP/1.1<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-settings.spccint.com<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: application/json; charset=text/plain<br>

Last-Modified: Sun, 10 Aug 2014 20:06:28 GMT<br>

ETag: "7ace2b0a2d45a9208d14608e8a3fea78"<br>

Server: Microsoft-IIS/7.5<br>

X-AspNet-Version: 4.0.30319<br>

X-Powered-By: ASP.NET<br>

Content-Length: 763<br>

Cache-Control: private, max-age=900<br>

Expires: Fri, 15 Aug 2014 16:24:23 GMT<br>

Date: Fri, 15 Aug 2014 16:09:23 GMT<br>

Connection: keep-alive<br><pre>{"InstallerSettings":{"CHExtension_Id":null,"CHExtension_LandingPage":<br>null,"CHExtension_Name":null,"DEFAULT_CMD":"-carrier_type=CTID -carrie<br>r_id=CT3331172 -Platform=all -startpage=true -defaultsearch=true -inst<br>all_time_revert=true","DUM":"2","InstallSPPDriver":null,"IsAUAllowedno<br>TB":"true","LOST_USERS":"false","PING":"false","SERVICE_LOST_USERS":nu<br>ll,"TbExternalAssetsEnable":"true","UNINSTALL_PING":"false"},"AbTestSe<br>ttings":{"Experiment":"","Variant":"","TestParameter":""},"CarrierSett<br>ings":{"CHExtensionMode":"false","v_env":"true","v_env_10":"true","v_e<br>nv_12":"false"},"signature":"PPJUtVBuf3mq4bSjHfCsPw0GVGgp99IghgIBJ9ghQ<br>yHjTCEGgcsEffb099GrCK7NwFnh16V1V6GO1QUTahcxWN9Saw2WlvY KWSHhWpPzWwBcHS<br>yChLzrmENQcLwfqx00VEJYOFQfuJlUaRc7cOOrUha8SZCLWiPBJ6S2ajhIuA="}..</pre></font><br><br

<font color="red">GET /addons/agup.exe HTTP/1.1<br>

Accept: */*<br>

User-Agent: TixDll<br>

Host: i1.installbox1.info<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: openresty<br>

Date: Fri, 15 Aug 2014 16:10:01 GMT<br>

Content-Type: application/octet-stream<br>

Content-Length: 1082880<br>

Last-Modified: Wed, 30 Jul 2014 00:07:01 GMT<br>

Connection: close<br>

ETag: "53d83725-108600"<br>

<<< skipped >>>

<font color="red">POST /?report_version=5& HTTP/1.1<br>

Accept: */*<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: TixDll<br>

Host: r2.monitorbox1.info<br>

Content-Length: 547<br>

Cache-Control: no-cache<br>

<br>

data=+pn5yxcBOV6//Ze+xzU6v/x/kjcRd6/D97CRLkpsNfv1PH6oxgzQL5E0nPsxD216/63uxYF7+99yRAvxLg3wryQYfFTG6JGx3Pcw6L+xN7cKCMZDLeJ5PJe+jAeYjUUmMqJqU1MxRUBjK1jbIfv8dd3n12qf0ALMprmcWI9XHmSs7oIFGrjUqqddyPiwioKJr8ckwjCJE9fVBA3lAuCWv1l9Wg+26b6nKBHNaHLyNGVkn6W5EUmVsq303FxUbQd6JEybvfQ6RkHIacrqoGZeCEM1av/Jhjo7Npm97Ydf/ys6g8TkflTW2p5iBG4BPiK04WvgQ/EoO75lpN0+MzxPFRZb3GN+If9Q179MFjfBp6Y/XnX6yJRpZ6Cq9V7hn0J9Oz4DqW9Juf8Kc9wttJAkVQYgsBjh41prwPJKOCZgHAA8C9dmexyBKuA3ZB+iKxeOzdyTRGpiK51j1J8MUpRt2KXkrDfXUhnTO7SthhzUyayG9wWZWUqDXUNkVr8UuK9eAetUD0tCUIHw</font><br><font color="blue">HTTP/1.1 200 OK<br>

Server: openresty<br>

Date: Fri, 15 Aug 2014 16:09:21 GMT<br>

Content-Type: application/json; charset=UTF-8<br>

Content-Length: 2<br>

Connection: close<br><pre>{}..</pre></font><br><br

<font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 429<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"MiniStub_Init", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C","environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true", "EXT_ISID":"false", "carrier_ID":"CT3309297", "machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG", "installer_version":"1.1.2.4", "origin":""}</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:07 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></font>....</pre></font><br><br><font color="red">POST / HTTP/1.1<br>

Content-Type: application/x-www-form-urlencoded<br>

User-Agent: NSIS_Inetc (Mozilla)<br>

Host: sp-installer.databssint.com<br>

Content-Length: 469<br>

Connection: Keep-Alive<br>

Cache-Control: no-cache<br>

<br>

{"event_type":"MiniStub_Complete", "installation_session_id":"M1E95D34D-01FE-4869-AA16-13BE9143470C","environment":"", "command_line":"-carrier_type=ctid -carrier_id=CT3309297 -platform=all -local=en-us -startpage=true -defaultsearch=true", "EXT_ISID":"false", "carrier_ID":"CT3309297", "machine_ID":"UPGGLP21ORZ3K5EA1X5F8YY1XNO5CI7N2QS4BF5DK6RX28AKIE0Z6STDXVY7DY/DBVFM8OXVWIBS0XSQ8FJ5NG", "installer_version":"1.1.2.4", "origin":"", "result":"success", "reason": "0" }</font><br><font color="blue">HTTP/1.1 202 Accepted<br>

Date: Fri, 15 Aug 2014 16:09:43 GMT<br>

P3P: CP="NOI ADM DEV COM NAV OUR STP"<br>

Server: Apache-Coyote/1.1<br>

Content-Length: 0<br>

Connection: keep-alive<br><pre></pre></font><br><br

Map

The Backdoor connects to the servers at the folowing location(s):

Strings from Dumps

CltMngSvc.exe_1912:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

.EKSWU

.EKSWU

\$$;\$0|

\$$;\$0|

DlSHA512 block transform for x86, CRYPTOGAMS by

DlSHA512 block transform for x86, CRYPTOGAMS by

Camellia for x86 by

Camellia for x86 by

AES for Intel AES-NI, CRYPTOGAMS by

AES for Intel AES-NI, CRYPTOGAMS by

6-9'6-9'

6-9'6-9'

$6.:$6.:

$6.:$6.:

*?#1*?#1

*?#1*?#1

>8$4,8$4,

>8$4,8$4,

AES for x86, CRYPTOGAMS by

AES for x86, CRYPTOGAMS by

RC4 for x86, CRYPTOGAMS by

RC4 for x86, CRYPTOGAMS by

Montgomery Multiplication for x86, CRYPTOGAMS by

Montgomery Multiplication for x86, CRYPTOGAMS by

SHA1 block transform for x86, CRYPTOGAMS by

SHA1 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

GHASH for x86, CRYPTOGAMS by

GHASH for x86, CRYPTOGAMS by

GF(2^m) Multiplication for x86, CRYPTOGAMS by

GF(2^m) Multiplication for x86, CRYPTOGAMS by

FtPS

FtPS

D$@j.Xf

D$@j.Xf

t.JuG

t.JuG

PSSSSSSh

PSSSSSSh

t.VVW

t.VVW

FTPj

FTPj

tCPQ

tCPQ

,4,56,789

,4,56,789

u.hLKe

u.hLKe

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

0123456789-

0123456789-

%b %d %H : %M : %S %Y

%b %d %H : %M : %S %Y

%m / %d / %y

%m / %d / %y

%I : %M : %S %p

%I : %M : %S %p

%d / %m / %y

%d / %m / %y

boost thread: trying joining itself

boost thread: trying joining itself

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Operation not permitted

Operation not permitted

Inappropriate I/O control operation

Inappropriate I/O control operation

Broken pipe

Broken pipe

operator

operator

GetProcessWindowStation

GetProcessWindowStation

kernel32.dll

kernel32.dll

left-curly-bracket

left-curly-bracket

right-curly-bracket

right-curly-bracket

RSA part of OpenSSL 1.0.1e 11 Feb 2013

RSA part of OpenSSL 1.0.1e 11 Feb 2013

SHA-512 part of OpenSSL 1.0.1e 11 Feb 2013

SHA-512 part of OpenSSL 1.0.1e 11 Feb 2013

ssl_sess_cert

ssl_sess_cert

ssl_cert

ssl_cert

evp_pkey

evp_pkey

x509_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

%s(%d): OpenSSL internal error, assertion failed: %s

passed a null parameter

passed a null parameter

DSO support routines

DSO support routines

x509 certificate routines

x509 certificate routines

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

pubkey

pubkey

PEM part of OpenSSL 1.0.1e 11 Feb 2013

PEM part of OpenSSL 1.0.1e 11 Feb 2013

enc_key

enc_key

key_enc_algor

key_enc_algor

cert

cert

d.encrypted

d.encrypted

d.digest

d.digest

d.signed_and_enveloped

d.signed_and_enveloped

d.enveloped

d.enveloped

d.sign

d.sign

d.data

d.data

d.other

d.other

NETSCAPE_CERT_SEQUENCE

NETSCAPE_CERT_SEQUENCE

certs

certs

X509_PUBKEY

X509_PUBKEY

public_key

public_key

.\crypto\asn1\x_pubkey.c

.\crypto\asn1\x_pubkey.c

DSA part of OpenSSL 1.0.1e 11 Feb 2013

DSA part of OpenSSL 1.0.1e 11 Feb 2013

priv_key

priv_key

pub_key

pub_key

.\crypto\ec\ec_key.c

.\crypto\ec\ec_key.c

EC_PRIVATEKEY

EC_PRIVATEKEY

publicKey

publicKey

privateKey

privateKey

value.implicitlyCA

value.implicitlyCA

value.parameters

value.parameters

value.named_curve

value.named_curve

p.char_two

p.char_two

p.prime

p.prime

p.ppBasis

p.ppBasis

p.tpBasis

p.tpBasis

p.onBasis

p.onBasis

p.other

p.other

Any Extended Key Usage

Any Extended Key Usage

anyExtendedKeyUsage

anyExtendedKeyUsage

supportedAlgorithms

supportedAlgorithms

crossCertificatePair

crossCertificatePair

certificateRevocationList

certificateRevocationList

cACertificate

cACertificate

userCertificate

userCertificate

userPassword

userPassword

supportedApplicationContext

supportedApplicationContext

Microsoft Local Key set

Microsoft Local Key set

LocalKeySet

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

password based MAC

id-PasswordBasedMAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

X509v3 Certificate Issuer

certificateIssuer

certificateIssuer

certicom-arc

certicom-arc

Proxy Certificate Information

Proxy Certificate Information

proxyCertInfo

proxyCertInfo

Microsoft Smartcardlogin

Microsoft Smartcardlogin

msSmartcardLogin

msSmartcardLogin

joint-iso-itu-t

joint-iso-itu-t

JOINT-ISO-ITU-T

JOINT-ISO-ITU-T

set-rootKeyThumb

set-rootKeyThumb

setAttr-Cert

setAttr-Cert

setCext-cCertRequired

setCext-cCertRequired

setCext-certType

setCext-certType

setct-CertResTBE

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBEX

setct-CertReqTBE

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertInqReqTBS

setct-CertResData

setct-CertResData

setct-CertReqTBS

setct-CertReqTBS

setct-CertReqData

setct-CertReqData

setct-PCertResTBS

setct-PCertResTBS

setct-PCertReqData

setct-PCertReqData

setct-AcqCardCodeMsg

setct-AcqCardCodeMsg

certificate extensions

certificate extensions

set-certExt

set-certExt

set-msgExt

set-msgExt

id-ecPublicKey

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-cmc-getCert

id-regInfo-certReq

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-ct-publishCert

id-smime-mod-msg-v3

id-smime-mod-msg-v3

sdsiCertificate

sdsiCertificate

x509Certificate

x509Certificate

localKeyID

localKeyID

certBag

certBag

pkcs8ShroudedKeyBag

pkcs8ShroudedKeyBag

keyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Client Authentication

TLS Web Server Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

X509v3 Extended Key Usage

extendedKeyUsage

extendedKeyUsage

X509v3 Authority Key Identifier

X509v3 Authority Key Identifier

authorityKeyIdentifier

authorityKeyIdentifier

X509v3 Certificate Policies

X509v3 Certificate Policies

certificatePolicies

certificatePolicies

X509v3 Private Key Usage Period

X509v3 Private Key Usage Period

privateKeyUsagePeriod

privateKeyUsagePeriod

X509v3 Key Usage

X509v3 Key Usage

keyUsage

keyUsage

X509v3 Subject Key Identifier

X509v3 Subject Key Identifier

subjectKeyIdentifier

subjectKeyIdentifier

Netscape Certificate Sequence

Netscape Certificate Sequence

nsCertSequence

nsCertSequence

Netscape CA Policy Url

Netscape CA Policy Url

nsCaPolicyUrl

nsCaPolicyUrl

Netscape Renewal Url

Netscape Renewal Url

nsRenewalUrl

nsRenewalUrl

Netscape CA Revocation Url

Netscape CA Revocation Url

nsCaRevocationUrl

nsCaRevocationUrl

Netscape Revocation Url

Netscape Revocation Url

nsRevocationUrl

nsRevocationUrl

Netscape Base Url

Netscape Base Url

nsBaseUrl

nsBaseUrl

Netscape Cert Type

Netscape Cert Type

nsCertType

nsCertType

Netscape Certificate Extension

Netscape Certificate Extension

nsCertExt

nsCertExt

extendedCertificateAttributes

extendedCertificateAttributes

challengePassword

challengePassword

dhKeyAgreement

dhKeyAgreement

%'%1%=%C%K%O%s%

%'%1%=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

C%C'C3C7C9COCWCiC

RAND part of OpenSSL 1.0.1e 11 Feb 2013

RAND part of OpenSSL 1.0.1e 11 Feb 2013

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

lhash part of OpenSSL 1.0.1e 11 Feb 2013

lhash part of OpenSSL 1.0.1e 11 Feb 2013

Stack part of OpenSSL 1.0.1e 11 Feb 2013

Stack part of OpenSSL 1.0.1e 11 Feb 2013

Diffie-Hellman part of OpenSSL 1.0.1e 11 Feb 2013

Diffie-Hellman part of OpenSSL 1.0.1e 11 Feb 2013

value.single

value.single

value.set

value.set

EVP part of OpenSSL 1.0.1e 11 Feb 2013

EVP part of OpenSSL 1.0.1e 11 Feb 2013

name.relativename

name.relativename

name.fullname

name.fullname

certificateHold

certificateHold

Certificate Hold

Certificate Hold

cessationOfOperation

cessationOfOperation

Cessation Of Operation

Cessation Of Operation

keyCompromise

keyCompromise

Key Compromise

Key Compromise

%*s%s:

%*s%s:

%*sOnly Attribute Certificates

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

%*sOnly User Certificates

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

d.registeredID

d.registeredID

d.iPAddress

d.iPAddress

d.uniformResourceIdentifier

d.uniformResourceIdentifier

d.ediPartyName

d.ediPartyName

d.directoryName

d.directoryName

d.dNSName

d.dNSName

d.rfc822Name

d.rfc822Name

d.otherName

d.otherName

AUTHORITY_KEYID

AUTHORITY_KEYID

keyid

keyid

cert_info

cert_info

PKCS8_PRIV_KEY_INFO

PKCS8_PRIV_KEY_INFO

pkey

pkey

pkeyalg

pkeyalg

EC part of OpenSSL 1.0.1e 11 Feb 2013

EC part of OpenSSL 1.0.1e 11 Feb 2013

USER32.DLL

USER32.DLL

NETAPI32.DLL

NETAPI32.DLL

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

.\crypto\dh\dh_key.c

.\crypto\dh\dh_key.c

%s: (%d bit)

%s: (%d bit)

Public-Key

Public-Key

Private-Key

Private-Key

recommended-private-length: %d bits

recommended-private-length: %d bits

public-key:

public-key:

private-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Public-Key: (%d bit)

Private-Key: (%d bit)

Private-Key: (%d bit)

SHA1 part of OpenSSL 1.0.1e 11 Feb 2013

SHA1 part of OpenSSL 1.0.1e 11 Feb 2013

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

RIPE-MD160 part of OpenSSL 1.0.1e 11 Feb 2013

RIPE-MD160 part of OpenSSL 1.0.1e 11 Feb 2013

SHA part of OpenSSL 1.0.1e 11 Feb 2013

SHA part of OpenSSL 1.0.1e 11 Feb 2013

MD5 part of OpenSSL 1.0.1e 11 Feb 2013

MD5 part of OpenSSL 1.0.1e 11 Feb 2013

MD4 part of OpenSSL 1.0.1e 11 Feb 2013

MD4 part of OpenSSL 1.0.1e 11 Feb 2013

AES part of OpenSSL 1.0.1e 11 Feb 2013

AES part of OpenSSL 1.0.1e 11 Feb 2013

CAST part of OpenSSL 1.0.1e 11 Feb 2013

CAST part of OpenSSL 1.0.1e 11 Feb 2013

Blowfish part of OpenSSL 1.0.1e 11 Feb 2013

Blowfish part of OpenSSL 1.0.1e 11 Feb 2013

:RC2 part of OpenSSL 1.0.1e 11 Feb 2013

:RC2 part of OpenSSL 1.0.1e 11 Feb 2013

.pp@0

.pp@0

aEÐ

aEÐ

(#EÚ

(#EÚ

ÚE

ÚE

IDEA part of OpenSSL 1.0.1e 11 Feb 2013

IDEA part of OpenSSL 1.0.1e 11 Feb 2013

libdes part of OpenSSL 1.0.1e 11 Feb 2013

libdes part of OpenSSL 1.0.1e 11 Feb 2013

DES part of OpenSSL 1.0.1e 11 Feb 2013

DES part of OpenSSL 1.0.1e 11 Feb 2013

\X

\X