Trojan.Siggen18.38486

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'OKAYFREEDOM_Agent' = '"%ProgramFiles(x86)%\OkayFreedom\OkayFreedomClient.exe" -agent'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'OKAYFREEDOM Notifier' = '"%ProgramFiles(x86)%\OkayFreedom\Notifier.exe"'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\OkayFreedom VPN Starter Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\OkayFreedom VPN Starter Service] 'ImagePath' = '"%ProgramFiles(x86)%\OkayFreedom\OkayFreedomService.exe"'

Creates the following services

'OkayFreedom VPN Starter Service' "%ProgramFiles(x86)%\OkayFreedom\OkayFreedomService.exe"
'OkayFreedom VPN Starter Service' %ProgramFiles(x86)%\OkayFreedom\OkayFreedomService.exe

Modifies file system

Creates the following files

%TEMP%\nsrea6e.tmp\system.dll
%ProgramFiles(x86)%\okayfreedom\dict\i\q
%ProgramFiles(x86)%\okayfreedom\dict\i\n
%ProgramFiles(x86)%\okayfreedom\dict\i\o
%ProgramFiles(x86)%\okayfreedom\dict\i\l
%ProgramFiles(x86)%\okayfreedom\dict\i\m
%ProgramFiles(x86)%\okayfreedom\dict\i\j
%ProgramFiles(x86)%\okayfreedom\dict\i\k
%ProgramFiles(x86)%\okayfreedom\dict\i\h
%ProgramFiles(x86)%\okayfreedom\dict\i\i
%ProgramFiles(x86)%\okayfreedom\dict\e\j
%ProgramFiles(x86)%\okayfreedom\dict\i\f
%ProgramFiles(x86)%\okayfreedom\dict\i\d
%ProgramFiles(x86)%\okayfreedom\dict\i\e
%ProgramFiles(x86)%\okayfreedom\dict\i\b
%ProgramFiles(x86)%\okayfreedom\dict\i\c
%ProgramFiles(x86)%\okayfreedom\dict\i\a
%ProgramFiles(x86)%\okayfreedom\dict\m\z
%ProgramFiles(x86)%\okayfreedom\dict\m\x
%ProgramFiles(x86)%\okayfreedom\dict\m\y
%ProgramFiles(x86)%\okayfreedom\dict\m\r
%ProgramFiles(x86)%\okayfreedom\dict\m\s
%ProgramFiles(x86)%\okayfreedom\dict\i\r
%ProgramFiles(x86)%\okayfreedom\dict\i\g
%ProgramFiles(x86)%\okayfreedom\dict\i\p
%ProgramFiles(x86)%\okayfreedom\dict\i\s
%ProgramFiles(x86)%\okayfreedom\dict\i\u
%ProgramFiles(x86)%\okayfreedom\dict\i\t
%ProgramFiles(x86)%\okayfreedom\dict\e\z
%ProgramFiles(x86)%\okayfreedom\dict\e\x
%ProgramFiles(x86)%\okayfreedom\dict\e\y
%ProgramFiles(x86)%\okayfreedom\dict\e\b
%ProgramFiles(x86)%\okayfreedom\dict\e\c
%ProgramFiles(x86)%\okayfreedom\dict\e\a
%ProgramFiles(x86)%\okayfreedom\dict\e\f
%ProgramFiles(x86)%\okayfreedom\dict\e\g
%ProgramFiles(x86)%\okayfreedom\dict\e\d
%ProgramFiles(x86)%\okayfreedom\dict\m\p
%ProgramFiles(x86)%\okayfreedom\dict\e\e
%ProgramFiles(x86)%\okayfreedom\dict\m\q
%ProgramFiles(x86)%\okayfreedom\dict\e\k
%ProgramFiles(x86)%\okayfreedom\dict\e\i
%ProgramFiles(x86)%\okayfreedom\dict\e\n
%ProgramFiles(x86)%\okayfreedom\dict\e\o
%ProgramFiles(x86)%\okayfreedom\dict\e\l
%ProgramFiles(x86)%\okayfreedom\dict\e\m
%ProgramFiles(x86)%\okayfreedom\dict\i\z
%ProgramFiles(x86)%\okayfreedom\dict\i\x
%ProgramFiles(x86)%\okayfreedom\dict\i\y
%ProgramFiles(x86)%\okayfreedom\dict\i\v
%ProgramFiles(x86)%\okayfreedom\dict\e\t
%ProgramFiles(x86)%\okayfreedom\dict\i\w
%ProgramFiles(x86)%\okayfreedom\dict\e\h
%ProgramFiles(x86)%\okayfreedom\dict\m\v
%ProgramFiles(x86)%\okayfreedom\dict\m\w
%ProgramFiles(x86)%\okayfreedom\dict\m\t
%ProgramFiles(x86)%\okayfreedom\dict\y\b
%ProgramFiles(x86)%\okayfreedom\dict\y\c
%ProgramFiles(x86)%\okayfreedom\dict\y\a
%ProgramFiles(x86)%\okayfreedom\dict\y\z
%ProgramFiles(x86)%\okayfreedom\dict\y\x
%ProgramFiles(x86)%\okayfreedom\dict\y\y
%ProgramFiles(x86)%\okayfreedom\dict\y\v
%ProgramFiles(x86)%\okayfreedom\dict\y\w
%ProgramFiles(x86)%\okayfreedom\dict\y\t
%ProgramFiles(x86)%\okayfreedom\dict\y\u
%ProgramFiles(x86)%\okayfreedom\dict\e\w
%ProgramFiles(x86)%\okayfreedom\dict\y\e
%ProgramFiles(x86)%\okayfreedom\dict\y\d
%ProgramFiles(x86)%\okayfreedom\dict\y\q
%ProgramFiles(x86)%\okayfreedom\dict\c\t
%ProgramFiles(x86)%\okayfreedom\dict\c\u
%ProgramFiles(x86)%\okayfreedom\dict\c\v
%ProgramFiles(x86)%\okayfreedom\dict\c\w
%ProgramFiles(x86)%\okayfreedom\dict\c\p
%ProgramFiles(x86)%\okayfreedom\dict\c\q
%ProgramFiles(x86)%\okayfreedom\dict\c\r
%ProgramFiles(x86)%\okayfreedom\dict\c\s
%ProgramFiles(x86)%\okayfreedom\dict\u\j
%ProgramFiles(x86)%\okayfreedom\dict\y\r
%ProgramFiles(x86)%\okayfreedom\dict\y\p
%ProgramFiles(x86)%\okayfreedom\dict\e\u
%ProgramFiles(x86)%\okayfreedom\dict\y\s
%ProgramFiles(x86)%\okayfreedom\dict\u\k
%ProgramFiles(x86)%\okayfreedom\dict\m\u
%ProgramFiles(x86)%\okayfreedom\dict\m\j
%ProgramFiles(x86)%\okayfreedom\dict\m\k
%ProgramFiles(x86)%\okayfreedom\dict\m\h
%ProgramFiles(x86)%\okayfreedom\dict\m\i
%ProgramFiles(x86)%\okayfreedom\dict\m\n
%ProgramFiles(x86)%\okayfreedom\dict\m\o
%ProgramFiles(x86)%\okayfreedom\dict\m\l
%ProgramFiles(x86)%\okayfreedom\dict\m\m
%ProgramFiles(x86)%\okayfreedom\dict\m\b
%ProgramFiles(x86)%\okayfreedom\dict\y\i
%ProgramFiles(x86)%\okayfreedom\dict\y\g
%ProgramFiles(x86)%\okayfreedom\dict\y\f
%ProgramFiles(x86)%\okayfreedom\dict\m\g
%ProgramFiles(x86)%\okayfreedom\dict\m\d
%ProgramFiles(x86)%\okayfreedom\dict\m\e
%ProgramFiles(x86)%\okayfreedom\dict\y\n
%ProgramFiles(x86)%\okayfreedom\dict\y\o
%ProgramFiles(x86)%\okayfreedom\dict\y\l
%ProgramFiles(x86)%\okayfreedom\dict\y\m
%ProgramFiles(x86)%\okayfreedom\dict\y\j
%ProgramFiles(x86)%\okayfreedom\dict\y\k
%ProgramFiles(x86)%\okayfreedom\dict\y\h
%ProgramFiles(x86)%\okayfreedom\dict\m\c
%ProgramFiles(x86)%\okayfreedom\dict\m\f
%ProgramFiles(x86)%\okayfreedom\dict\d\a
%ProgramFiles(x86)%\okayfreedom\dict\m\a
%ProgramFiles(x86)%\okayfreedom\dict\l\s
%ProgramFiles(x86)%\okayfreedom\dict\h\h
%ProgramFiles(x86)%\okayfreedom\dict\h\g
%ProgramFiles(x86)%\okayfreedom\dict\h\f
%ProgramFiles(x86)%\okayfreedom\dict\h\e
%ProgramFiles(x86)%\okayfreedom\dict\h\d
%ProgramFiles(x86)%\okayfreedom\dict\h\c
%ProgramFiles(x86)%\okayfreedom\dict\h\b
%ProgramFiles(x86)%\okayfreedom\dict\h\a
%ProgramFiles(x86)%\okayfreedom\dict\h\z
%ProgramFiles(x86)%\okayfreedom\dict\d\s
%ProgramFiles(x86)%\okayfreedom\dict\h\y
%ProgramFiles(x86)%\okayfreedom\dict\h\w
%ProgramFiles(x86)%\okayfreedom\dict\h\v
%ProgramFiles(x86)%\okayfreedom\dict\h\u
%ProgramFiles(x86)%\okayfreedom\dict\h\t
%ProgramFiles(x86)%\okayfreedom\dict\h\s
%ProgramFiles(x86)%\okayfreedom\dict\h\r
%ProgramFiles(x86)%\okayfreedom\dict\h\q
%ProgramFiles(x86)%\okayfreedom\dict\h\p
%ProgramFiles(x86)%\okayfreedom\dict\l\k
%ProgramFiles(x86)%\okayfreedom\dict\l\j
%ProgramFiles(x86)%\okayfreedom\dict\h\k
%ProgramFiles(x86)%\okayfreedom\dict\h\x
%ProgramFiles(x86)%\okayfreedom\dict\h\i
%ProgramFiles(x86)%\okayfreedom\dict\h\j
%ProgramFiles(x86)%\okayfreedom\dict\h\l
%ProgramFiles(x86)%\okayfreedom\dict\h\m
%ProgramFiles(x86)%\okayfreedom\dict\d\e
%ProgramFiles(x86)%\okayfreedom\dict\d\d
%ProgramFiles(x86)%\okayfreedom\dict\d\k
%ProgramFiles(x86)%\okayfreedom\dict\d\j
%ProgramFiles(x86)%\okayfreedom\dict\d\i
%ProgramFiles(x86)%\okayfreedom\dict\d\h
%ProgramFiles(x86)%\okayfreedom\dict\d\o
%ProgramFiles(x86)%\okayfreedom\dict\d\n
%ProgramFiles(x86)%\okayfreedom\dict\d\m
%ProgramFiles(x86)%\okayfreedom\dict\l\i
%ProgramFiles(x86)%\okayfreedom\dict\d\l
%ProgramFiles(x86)%\okayfreedom\dict\l\h
%ProgramFiles(x86)%\okayfreedom\dict\d\r
%ProgramFiles(x86)%\okayfreedom\dict\d\p
%ProgramFiles(x86)%\okayfreedom\dict\d\w
%ProgramFiles(x86)%\okayfreedom\dict\d\v
%ProgramFiles(x86)%\okayfreedom\dict\d\u
%ProgramFiles(x86)%\okayfreedom\dict\d\t
%ProgramFiles(x86)%\okayfreedom\dict\d\z
%ProgramFiles(x86)%\okayfreedom\dict\d\y
%ProgramFiles(x86)%\okayfreedom\dict\d\x
%ProgramFiles(x86)%\okayfreedom\dict\h\o
%ProgramFiles(x86)%\okayfreedom\dict\d\g
%ProgramFiles(x86)%\okayfreedom\dict\h\n
%ProgramFiles(x86)%\okayfreedom\dict\d\q
%ProgramFiles(x86)%\okayfreedom\dict\l\o
%ProgramFiles(x86)%\okayfreedom\dict\l\n
%ProgramFiles(x86)%\okayfreedom\dict\l\m
%ProgramFiles(x86)%\okayfreedom\dict\a\s
%ProgramFiles(x86)%\okayfreedom\dict\a\p
%ProgramFiles(x86)%\okayfreedom\dict\a\q
%ProgramFiles(x86)%\okayfreedom\dict\a\z
%ProgramFiles(x86)%\okayfreedom\dict\a\x
%ProgramFiles(x86)%\okayfreedom\dict\a\y
%ProgramFiles(x86)%\okayfreedom\dict\a\f
%ProgramFiles(x86)%\okayfreedom\dict\a\g
%ProgramFiles(x86)%\okayfreedom\dict\a\d
%ProgramFiles(x86)%\okayfreedom\dict\a\e
%ProgramFiles(x86)%\okayfreedom\dict\e\q
%ProgramFiles(x86)%\okayfreedom\dict\a\r
%ProgramFiles(x86)%\okayfreedom\dict\a\u
%ProgramFiles(x86)%\okayfreedom\dict\a\n
%ProgramFiles(x86)%\okayfreedom\dict\a\o
%ProgramFiles(x86)%\okayfreedom\dict\a\l
%ProgramFiles(x86)%\okayfreedom\dict\a\m
%ProgramFiles(x86)%\okayfreedom\dict\a\j
%ProgramFiles(x86)%\okayfreedom\dict\a\k
%ProgramFiles(x86)%\okayfreedom\dict\a\h
%ProgramFiles(x86)%\okayfreedom\dict\a\i
%ProgramFiles(x86)%\okayfreedom\dict\e\r
%ProgramFiles(x86)%\okayfreedom\dict\e\s
%ProgramFiles(x86)%\okayfreedom\dict\a\b
%ProgramFiles(x86)%\okayfreedom\dict\a\a
%ProgramFiles(x86)%\okayfreedom\dict\e\v
%ProgramFiles(x86)%\okayfreedom\dict\a\c
%ProgramFiles(x86)%\okayfreedom\dict\e\p
%ProgramFiles(x86)%\okayfreedom\dict\l\l
%ProgramFiles(x86)%\okayfreedom\dict\l\c
%ProgramFiles(x86)%\okayfreedom\dict\l\b
%ProgramFiles(x86)%\okayfreedom\dict\l\a
%ProgramFiles(x86)%\okayfreedom\dict\l\g
%ProgramFiles(x86)%\okayfreedom\dict\l\f
%ProgramFiles(x86)%\okayfreedom\dict\l\e
%ProgramFiles(x86)%\okayfreedom\dict\l\d
%ProgramFiles(x86)%\okayfreedom\dict\l\z
%ProgramFiles(x86)%\okayfreedom\dict\l\y
%ProgramFiles(x86)%\okayfreedom\dict\a\v
%ProgramFiles(x86)%\okayfreedom\dict\a\t
%ProgramFiles(x86)%\okayfreedom\dict\a\w
%ProgramFiles(x86)%\okayfreedom\dict\l\q
%ProgramFiles(x86)%\okayfreedom\dict\l\p
%ProgramFiles(x86)%\okayfreedom\dict\l\w
%ProgramFiles(x86)%\okayfreedom\dict\l\v
%ProgramFiles(x86)%\okayfreedom\dict\l\u
%ProgramFiles(x86)%\okayfreedom\dict\l\t
%ProgramFiles(x86)%\okayfreedom\dict\u\a
%ProgramFiles(x86)%\okayfreedom\dict\u\f
%ProgramFiles(x86)%\okayfreedom\dict\u\g
%ProgramFiles(x86)%\okayfreedom\dict\u\e
%ProgramFiles(x86)%\okayfreedom\dict\l\x
%ProgramFiles(x86)%\okayfreedom\dict\l\r
%ProgramFiles(x86)%\okayfreedom\dict\d\f
%ProgramFiles(x86)%\okayfreedom\dict\u\h
%ProgramFiles(x86)%\okayfreedom\dict\u\m
%ProgramFiles(x86)%\okayfreedom\msvcr90.dll
%ProgramFiles(x86)%\okayfreedom\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\okayfreedom\msvcp90.dll
%ProgramFiles(x86)%\okayfreedom\concrt140.dll
%ProgramFiles(x86)%\okayfreedom\vcruntime140.dll
%ProgramFiles(x86)%\okayfreedom\vccorlib140.dll
%ProgramFiles(x86)%\okayfreedom\msvcp140.dll
%ProgramFiles(x86)%\okayfreedom\uninstall.exe
%TEMP%\nsrea6e.tmp\processes.dll
%TEMP%\nsrea6e.tmp\dumplog.dll
%ProgramFiles(x86)%\okayfreedom\notifier.exe
%ProgramFiles(x86)%\okayfreedom\install.log
%APPDATA%\steganos\updater.exe.log
%APPDATA%\steganos\vpn\upw_okayfreedom
%APPDATA%\steganos\vpn\okayfreedom.crt
%APPDATA%\steganos\vpn\a1f2-0228-d4da-a30e-39b4-21e8-0186-c2e2.crt
%APPDATA%\steganos\vpn\a1f2-0228-d4da-a30e-39b4-21e8-0186-c2e2.key
%APPDATA%\steganos\res\bmp_flag_at_checked16.png
%APPDATA%\steganos\res\bmp_flag_at64.png
%APPDATA%\steganos\res\idi_flag_at.ico
%APPDATA%\steganos\res\bmp_flag_au16.png
%APPDATA%\steganos\res\bmp_flag_au_checked16.png
%ProgramFiles(x86)%\okayfreedom\updater.exe
%ProgramFiles(x86)%\okayfreedom\msvcm90.dll
%ProgramFiles(x86)%\okayfreedom\uninstallwindow.exe
%ProgramFiles(x86)%\okayfreedom\dict\u\y
%APPDATA%\steganos\res\idi_flag_au.ico
%ProgramFiles(x86)%\okayfreedom\dict\q\o
%ProgramFiles(x86)%\okayfreedom\dict\q\l
%ProgramFiles(x86)%\okayfreedom\dict\q\m
%ProgramFiles(x86)%\okayfreedom\dict\q\j
%ProgramFiles(x86)%\okayfreedom\dict\q\k
%ProgramFiles(x86)%\okayfreedom\dict\q\h
%ProgramFiles(x86)%\okayfreedom\dict\q\i
%ProgramFiles(x86)%\okayfreedom\dict\q\v
%ProgramFiles(x86)%\okayfreedom\dict\q\w
%APPDATA%\steganos\res\bmp_flag_au64.png
%ProgramFiles(x86)%\okayfreedom\dict\q\a
%APPDATA%\steganos\notifier.exe.log
%ProgramFiles(x86)%\okayfreedom\dict\q\t
%ProgramFiles(x86)%\okayfreedom\dict\q\p
%ProgramFiles(x86)%\okayfreedom\dict\q\q
%ProgramFiles(x86)%\okayfreedom\dict\q\z
%ProgramFiles(x86)%\okayfreedom\dict\q\x
%ProgramFiles(x86)%\okayfreedom\dict\q\y
%ProgramFiles(x86)%\okayfreedom\dict\u\t
%ProgramFiles(x86)%\okayfreedom\dict\u\u
%ProgramFiles(x86)%\okayfreedom\dict\u\z
%ProgramFiles(x86)%\okayfreedom\dict\u\x
%ProgramFiles(x86)%\okayfreedom\dict\q\u
%ProgramFiles(x86)%\okayfreedom\dict\q\r
%ProgramFiles(x86)%\okayfreedom\dict\q\s
%ProgramFiles(x86)%\okayfreedom\dict\p\r
%APPDATA%\steganos\res\bmp_flag_br16.png
%APPDATA%\steganos\res\bmp_flag_nl64.png
%APPDATA%\steganos\res\idi_flag_nl.ico
%APPDATA%\steganos\res\bmp_flag_no16.png
%APPDATA%\steganos\res\bmp_flag_no_checked16.png
%APPDATA%\steganos\res\bmp_flag_no64.png
%APPDATA%\steganos\res\idi_flag_no.ico
%APPDATA%\steganos\res\bmp_flag_pl16.png
%APPDATA%\steganos\res\bmp_flag_pl_checked16.png
%APPDATA%\steganos\res\bmp_flag_pl64.png
%APPDATA%\steganos\res\idi_flag_pl.ico
%APPDATA%\steganos\res\bmp_flag_ro64.png
%APPDATA%\steganos\res\idi_flag_jp.ico
%ProgramFiles(x86)%\okayfreedom\dict\q\c
%APPDATA%\steganos\res\bmp_flag_jp64.png
%APPDATA%\steganos\res\bmp_flag_ru64.png
%APPDATA%\steganos\res\idi_flag_ru.ico
%APPDATA%\steganos\res\bmp_flag_se16.png
%APPDATA%\steganos\res\bmp_flag_se_checked16.png
%APPDATA%\steganos\res\bmp_flag_se64.png
%APPDATA%\steganos\res\idi_flag_se.ico
%APPDATA%\steganos\res\bmp_flag_sg64.png
%APPDATA%\steganos\res\idi_flag_sg.ico
%APPDATA%\steganos\res\bmp_flag_tr64.png
%APPDATA%\steganos\res\idi_flag_tr.ico
%APPDATA%\steganos\res\bmp_flag_ru16.png
%APPDATA%\steganos\res\idi_flag_ro.ico
%ProgramFiles(x86)%\okayfreedom\dict\q\n
%APPDATA%\steganos\res\bmp_flag_it64.png
%APPDATA%\steganos\res\bmp_flag_fi16.png
%APPDATA%\steganos\res\idi_flag_br.ico
%APPDATA%\steganos\res\bmp_flag_ca16.png
%APPDATA%\steganos\res\bmp_flag_ca_checked16.png
%APPDATA%\steganos\res\bmp_flag_ca64.png
%APPDATA%\steganos\res\idi_flag_ca.ico
%APPDATA%\steganos\res\bmp_flag_ch64.png
%APPDATA%\steganos\res\bmp_flag_de64.png
%APPDATA%\steganos\res\bmp_flag_dk16.png
%APPDATA%\steganos\res\bmp_flag_dk_checked16.png
%APPDATA%\steganos\res\bmp_flag_dk64.png
%APPDATA%\steganos\res\idi_flag_it.ico
%APPDATA%\steganos\res\bmp_flag_br_checked16.png
%APPDATA%\steganos\res\bmp_flag_br64.png
%APPDATA%\steganos\res\bmp_flag_fi_checked16.png
%APPDATA%\steganos\res\bmp_flag_fi64.png
%APPDATA%\steganos\res\idi_flag_fi.ico
%APPDATA%\steganos\res\bmp_flag_fr64.png
%APPDATA%\steganos\res\bmp_flag_in16.png
%APPDATA%\steganos\res\bmp_flag_in_checked16.png
%APPDATA%\steganos\res\bmp_flag_in64.png
%APPDATA%\steganos\res\idi_flag_in.ico
%APPDATA%\steganos\res\bmp_flag_it16.png
%APPDATA%\steganos\res\bmp_flag_it_checked16.png
%APPDATA%\steganos\res\bmp_flag_es64.png
%APPDATA%\steganos\res\idi_flag_dk.ico
%ProgramFiles(x86)%\okayfreedom\dict\c\x
%ProgramFiles(x86)%\okayfreedom\dict\u\i
%ProgramFiles(x86)%\okayfreedom\dict\q\d
%ProgramFiles(x86)%\okayfreedom\dict\g\b
%ProgramFiles(x86)%\okayfreedom\dict\g\c
%ProgramFiles(x86)%\okayfreedom\dict\g\d
%ProgramFiles(x86)%\okayfreedom\dict\g\e
%ProgramFiles(x86)%\okayfreedom\dict\g\f
%ProgramFiles(x86)%\okayfreedom\dict\g\g
%ProgramFiles(x86)%\okayfreedom\dict\g\h
%ProgramFiles(x86)%\okayfreedom\dict\g\i
%ProgramFiles(x86)%\okayfreedom\dict\g\j
%ProgramFiles(x86)%\okayfreedom\dict\u\c
%ProgramFiles(x86)%\okayfreedom\dict\g\k
%ProgramFiles(x86)%\okayfreedom\dict\g\m
%ProgramFiles(x86)%\okayfreedom\dict\g\n
%ProgramFiles(x86)%\okayfreedom\dict\g\o
%ProgramFiles(x86)%\okayfreedom\dict\u\p
%ProgramFiles(x86)%\okayfreedom\dict\u\s
%ProgramFiles(x86)%\okayfreedom\dict\u\q
%ProgramFiles(x86)%\okayfreedom\dict\u\b
%ProgramFiles(x86)%\okayfreedom\dict\k\x
%ProgramFiles(x86)%\okayfreedom\dict\k\y
%ProgramFiles(x86)%\okayfreedom\dict\g\x
%ProgramFiles(x86)%\okayfreedom\dict\g\w
%ProgramFiles(x86)%\okayfreedom\dict\g\l
%ProgramFiles(x86)%\okayfreedom\dict\g\a
%ProgramFiles(x86)%\okayfreedom\dict\g\z
%ProgramFiles(x86)%\okayfreedom\dict\g\v
%ProgramFiles(x86)%\okayfreedom\dict\g\u
%ProgramFiles(x86)%\okayfreedom\dict\c\d
%ProgramFiles(x86)%\okayfreedom\dict\c\e
%ProgramFiles(x86)%\okayfreedom\dict\c\f
%ProgramFiles(x86)%\okayfreedom\dict\c\g
%ProgramFiles(x86)%\okayfreedom\dict\u\v
%ProgramFiles(x86)%\okayfreedom\dict\c\a
%ProgramFiles(x86)%\okayfreedom\dict\c\b
%ProgramFiles(x86)%\okayfreedom\dict\c\c
%ProgramFiles(x86)%\okayfreedom\dict\k\z
%ProgramFiles(x86)%\okayfreedom\dict\c\l
%ProgramFiles(x86)%\okayfreedom\dict\c\n
%ProgramFiles(x86)%\okayfreedom\dict\k\t
%ProgramFiles(x86)%\okayfreedom\dict\c\o
%ProgramFiles(x86)%\okayfreedom\dict\c\i
%ProgramFiles(x86)%\okayfreedom\dict\c\j
%ProgramFiles(x86)%\okayfreedom\dict\c\k
%ProgramFiles(x86)%\okayfreedom\dict\g\p
%ProgramFiles(x86)%\okayfreedom\dict\g\q
%ProgramFiles(x86)%\okayfreedom\dict\g\r
%ProgramFiles(x86)%\okayfreedom\dict\g\s
%ProgramFiles(x86)%\okayfreedom\dict\g\t
%ProgramFiles(x86)%\okayfreedom\dict\c\m
%ProgramFiles(x86)%\okayfreedom\dict\c\z
%ProgramFiles(x86)%\okayfreedom\dict\c\y
%ProgramFiles(x86)%\okayfreedom\dict\c\h
%ProgramFiles(x86)%\okayfreedom\dict\k\u
%ProgramFiles(x86)%\okayfreedom\dict\o\s
%ProgramFiles(x86)%\okayfreedom\dict\k\w
%ProgramFiles(x86)%\okayfreedom\dict\o\u
%ProgramFiles(x86)%\okayfreedom\dict\o\v
%ProgramFiles(x86)%\okayfreedom\dict\o\h
%ProgramFiles(x86)%\okayfreedom\dict\o\i
%ProgramFiles(x86)%\okayfreedom\dict\o\j
%ProgramFiles(x86)%\okayfreedom\dict\o\k
%ProgramFiles(x86)%\okayfreedom\dict\o\l
%ProgramFiles(x86)%\okayfreedom\dict\o\m
%ProgramFiles(x86)%\okayfreedom\dict\o\n
%ProgramFiles(x86)%\okayfreedom\dict\o\r
%ProgramFiles(x86)%\okayfreedom\dict\o\q
%ProgramFiles(x86)%\okayfreedom\dict\o\t
%ProgramFiles(x86)%\okayfreedom\dict\o\o
%ProgramFiles(x86)%\okayfreedom\dict\o\d
%ProgramFiles(x86)%\okayfreedom\dict\o\e
%ProgramFiles(x86)%\okayfreedom\dict\o\f
%ProgramFiles(x86)%\okayfreedom\dict\o\g
%ProgramFiles(x86)%\okayfreedom\dict\u\n
%ProgramFiles(x86)%\okayfreedom\dict\u\o
%ProgramFiles(x86)%\okayfreedom\dict\u\l
%ProgramFiles(x86)%\okayfreedom\dict\q\f
%ProgramFiles(x86)%\okayfreedom\dict\q\g
%ProgramFiles(x86)%\okayfreedom\dict\o\a
%ProgramFiles(x86)%\okayfreedom\dict\o\b
%ProgramFiles(x86)%\okayfreedom\dict\o\c
%ProgramFiles(x86)%\okayfreedom\dict\q\b
%ProgramFiles(x86)%\okayfreedom\dict\q\e
%ProgramFiles(x86)%\okayfreedom\dict\g\y
%ProgramFiles(x86)%\okayfreedom\dict\k\p
%ProgramFiles(x86)%\okayfreedom\dict\k\q
%ProgramFiles(x86)%\okayfreedom\dict\k\r
%ProgramFiles(x86)%\okayfreedom\dict\k\s
%ProgramFiles(x86)%\okayfreedom\dict\k\l
%ProgramFiles(x86)%\okayfreedom\dict\k\m
%ProgramFiles(x86)%\okayfreedom\dict\k\n
%ProgramFiles(x86)%\okayfreedom\dict\k\o
%ProgramFiles(x86)%\okayfreedom\dict\k\h
%ProgramFiles(x86)%\okayfreedom\dict\o\p
%ProgramFiles(x86)%\okayfreedom\dict\k\v
%ProgramFiles(x86)%\okayfreedom\dict\u\d
%ProgramFiles(x86)%\okayfreedom\dict\k\i
%ProgramFiles(x86)%\okayfreedom\dict\k\e
%ProgramFiles(x86)%\okayfreedom\dict\k\f
%ProgramFiles(x86)%\okayfreedom\dict\k\g
%ProgramFiles(x86)%\okayfreedom\dict\k\a
%ProgramFiles(x86)%\okayfreedom\dict\k\b
%ProgramFiles(x86)%\okayfreedom\dict\k\c
%ProgramFiles(x86)%\okayfreedom\dict\o\x
%ProgramFiles(x86)%\okayfreedom\dict\o\y
%ProgramFiles(x86)%\okayfreedom\dict\o\z
%ProgramFiles(x86)%\okayfreedom\dict\k\j
%ProgramFiles(x86)%\okayfreedom\dict\k\k
%ProgramFiles(x86)%\okayfreedom\dict\k\d
%ProgramFiles(x86)%\okayfreedom\dict\d\b
%ProgramFiles(x86)%\okayfreedom\dict\d\c
%ProgramFiles(x86)%\okayfreedom\dict\n\z
%ProgramFiles(x86)%\okayfreedom\dict\s\k
%ProgramFiles(x86)%\okayfreedom\dict\s\t
%ProgramFiles(x86)%\okayfreedom\dict\s\u
%ProgramFiles(x86)%\okayfreedom\dict\s\v
%ProgramFiles(x86)%\okayfreedom\dict\s\w
%ProgramFiles(x86)%\okayfreedom\dict\s\p
%ProgramFiles(x86)%\okayfreedom\dict\s\q
%ProgramFiles(x86)%\okayfreedom\dict\s\r
%ProgramFiles(x86)%\okayfreedom\dict\s\s
%ProgramFiles(x86)%\okayfreedom\dict\s\x
%ProgramFiles(x86)%\okayfreedom\dict\w\k
%ProgramFiles(x86)%\okayfreedom\dict\s\y
%ProgramFiles(x86)%\okayfreedom\dict\w\a
%ProgramFiles(x86)%\okayfreedom\dict\w\b
%ProgramFiles(x86)%\okayfreedom\dict\w\c
%ProgramFiles(x86)%\okayfreedom\dict\w\d
%ProgramFiles(x86)%\okayfreedom\dict\w\e
%ProgramFiles(x86)%\okayfreedom\dict\w\f
%ProgramFiles(x86)%\okayfreedom\dict\w\g
%ProgramFiles(x86)%\okayfreedom\dict\w\h
%ProgramFiles(x86)%\okayfreedom\dict\w\i
%ProgramFiles(x86)%\okayfreedom\dict\s\h
%ProgramFiles(x86)%\okayfreedom\dict\s\o
%ProgramFiles(x86)%\okayfreedom\dict\s\j
%ProgramFiles(x86)%\okayfreedom\dict\s\n
%ProgramFiles(x86)%\okayfreedom\dict\s\m
%ProgramFiles(x86)%\okayfreedom\libshred.dll
%APPDATA%\steganos\okayfreedom\okf_template.htm
%ProgramFiles(x86)%\okayfreedom\okayfreedomservice.exe
%ProgramFiles(x86)%\okayfreedom\openvpn\libpkcs11-helper-1.dll
%APPDATA%\steganos\okayfreedom\progressbar_bg.png
%TEMP%\nsrea6e.tmp\nsexec.dll
%APPDATA%\steganos\vpn\netsvwrap.msi
%TEMP%\nsrea6e.tmp\simplesc.dll
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\ext2e60.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{db981cca-088e-4731-a4a2-2fe218703c0e}.xpi
%ProgramFiles(x86)%\okayfreedom\dict\w\j
%APPDATA%\steganos\okayfreedomclient.exe.log
%ProgramFiles(x86)%\okayfreedom\dict\s\z
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\okayfreedom\okayfreedom.lnk
%APPDATA%\microsoft\internet explorer\quick launch\okayfreedom.lnk
%ProgramFiles(x86)%\okayfreedom\dict\s\d
%ProgramFiles(x86)%\okayfreedom\dict\s\e
%ProgramFiles(x86)%\okayfreedom\dict\s\f
%ProgramFiles(x86)%\okayfreedom\dict\s\g
%ProgramFiles(x86)%\okayfreedom\dict\s\a
%ProgramFiles(x86)%\okayfreedom\dict\s\b
%ProgramFiles(x86)%\okayfreedom\dict\s\c
%ProgramFiles(x86)%\okayfreedom\dict\s\l
%APPDATA%\steganos\vpn.dll.log
%ProgramFiles(x86)%\okayfreedom\openvpn64\readme.txt
C:\users\public\desktop\okayfreedom.lnk
%ProgramFiles(x86)%\okayfreedom\dict\w\l
%ProgramFiles(x86)%\okayfreedom\dict\w\m
%ProgramFiles(x86)%\okayfreedom\dict\z\a
%ProgramFiles(x86)%\okayfreedom\dict\z\c
%ProgramFiles(x86)%\okayfreedom\dict\z\b
%ProgramFiles(x86)%\okayfreedom\dict\z\m
%ProgramFiles(x86)%\okayfreedom\dict\z\l
%ProgramFiles(x86)%\okayfreedom\dict\z\o
%ProgramFiles(x86)%\okayfreedom\dict\z\n
%ProgramFiles(x86)%\okayfreedom\dict\z\i
%ProgramFiles(x86)%\okayfreedom\dict\z\h
%ProgramFiles(x86)%\okayfreedom\dict\z\k
%ProgramFiles(x86)%\okayfreedom\dict\z\j
%ProgramFiles(x86)%\okayfreedom\dict\z\f
%ProgramFiles(x86)%\okayfreedom\openvpn\lzo2.dll
%ProgramFiles(x86)%\okayfreedom\dict\z\g
%ProgramFiles(x86)%\okayfreedom\dict\r\l
%ProgramFiles(x86)%\okayfreedom\dict\r\o
%ProgramFiles(x86)%\okayfreedom\dict\r\n
%ProgramFiles(x86)%\okayfreedom\dict\r\i
%ProgramFiles(x86)%\okayfreedom\dict\r\h
%ProgramFiles(x86)%\okayfreedom\dict\r\k
%ProgramFiles(x86)%\okayfreedom\dict\r\j
%ProgramFiles(x86)%\okayfreedom\dict\r\e
%ProgramFiles(x86)%\okayfreedom\dict\r\d
%ProgramFiles(x86)%\okayfreedom\dict\r\g
%ProgramFiles(x86)%\okayfreedom\dict\u\w
%ProgramFiles(x86)%\okayfreedom\dict\u\r
%ProgramFiles(x86)%\okayfreedom\dict\r\f
%ProgramFiles(x86)%\okayfreedom\dict\z\e
%ProgramFiles(x86)%\okayfreedom\dict\z\u
%ProgramFiles(x86)%\okayfreedom\dict\w\o
%ProgramFiles(x86)%\okayfreedom\dict\w\p
%ProgramFiles(x86)%\okayfreedom\dict\w\q
%ProgramFiles(x86)%\okayfreedom\dict\w\r
%ProgramFiles(x86)%\okayfreedom\dict\w\s
%ProgramFiles(x86)%\okayfreedom\dict\w\t
%ProgramFiles(x86)%\okayfreedom\dict\w\u
%ProgramFiles(x86)%\okayfreedom\dict\w\v
%ProgramFiles(x86)%\okayfreedom\dict\w\w
%ProgramFiles(x86)%\okayfreedom\dict\w\x
%ProgramFiles(x86)%\okayfreedom\dict\z\d
%ProgramFiles(x86)%\okayfreedom\openvpn\liblzo2-2.dll
%ProgramFiles(x86)%\okayfreedom\dict\w\n
%ProgramFiles(x86)%\okayfreedom\dict\z\t
%ProgramFiles(x86)%\okayfreedom\dict\z\w
%ProgramFiles(x86)%\okayfreedom\dict\z\v
%ProgramFiles(x86)%\okayfreedom\dict\z\q
%ProgramFiles(x86)%\okayfreedom\dict\z\p
%ProgramFiles(x86)%\okayfreedom\dict\z\s
%ProgramFiles(x86)%\okayfreedom\dict\z\r
%ProgramFiles(x86)%\okayfreedom\dict\z\y
%ProgramFiles(x86)%\okayfreedom\dict\z\x
%ProgramFiles(x86)%\okayfreedom\dict\z\z
%ProgramFiles(x86)%\okayfreedom\dict\w\z
%ProgramFiles(x86)%\okayfreedom\dict\w\y
%ProgramFiles(x86)%\okayfreedom\dict\r\m
%ProgramFiles(x86)%\okayfreedom\openvpn\openvpn.exe
%ProgramFiles(x86)%\okayfreedom\infohelper.cfg
%ProgramFiles(x86)%\okayfreedom\xvpnclient_okayfreedom.res
%ProgramFiles(x86)%\okayfreedom\okayfreedom.res
%ProgramFiles(x86)%\okayfreedom\okayfreedom_ff.xpi
%ProgramFiles(x86)%\okayfreedom\okayfreedom.product.ico
%ProgramFiles(x86)%\okayfreedom\xvpnclient.res
%ProgramFiles(x86)%\okayfreedom\channeldefault.res
%ProgramFiles(x86)%\okayfreedom\okayfreedomclient.exe
%APPDATA%\steganos\okayfreedom\okf_traffic_exceeded_en.png
%ProgramFiles(x86)%\okayfreedom\okayfreedomservicestarter.exe
%ProgramFiles(x86)%\okayfreedom\sqlite3.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\openvpn.exe
%ProgramFiles(x86)%\okayfreedom\openvpn\tapinstall.exe
%ProgramFiles(x86)%\okayfreedom\openvpn64\msvcr90.dll
%ProgramFiles(x86)%\okayfreedom\servicecontrol.exe
%ProgramFiles(x86)%\okayfreedom\openvpn\readme.txt
%ProgramFiles(x86)%\okayfreedom\openvpn64\microsoft.vc90.crt.manifest
%APPDATA%\steganos\okayfreedom\okf_license_expired_de.jpg
%ProgramFiles(x86)%\okayfreedom\openvpn\ports
%ProgramFiles(x86)%\okayfreedom\openvpn64\ports
%ProgramFiles(x86)%\okayfreedom\renametap.exe
%APPDATA%\steganos\okayfreedom\okf_traffic_exceeded_jp.png
%ProgramFiles(x86)%\okayfreedom\openvpn\xp\oemwin2k.inf
%ProgramFiles(x86)%\okayfreedom\openvpn\tap0901.sys
%ProgramFiles(x86)%\okayfreedom\openvpn\xp\tap0901.sys
%ProgramFiles(x86)%\okayfreedom\openvpn\tap0901.cat
%ProgramFiles(x86)%\okayfreedom\openvpn\oemvista.inf
%TEMP%\nsrea6e.tmp\uac.dll
%ProgramFiles(x86)%\okayfreedom\prodid
%ProgramFiles(x86)%\okayfreedom\okayfreedomclient.res
%ProgramFiles(x86)%\okayfreedom\steganosui.res
%ProgramFiles(x86)%\okayfreedom\updater.res
%ProgramFiles(x86)%\okayfreedom\tleilaxu.res
%ProgramFiles(x86)%\okayfreedom\base.res
%ProgramFiles(x86)%\okayfreedom\7-zip\7-zip.chm
%ProgramFiles(x86)%\okayfreedom\7-zip\7za.exe
%ProgramFiles(x86)%\okayfreedom\7-zip\license.txt
%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe
%ProgramFiles(x86)%\okayfreedom\7-zip\readme.txt
%ProgramFiles(x86)%\okayfreedom\shutdownapp.exe
%ProgramFiles(x86)%\okayfreedom\openvpn64\deltapall.bat
%ProgramFiles(x86)%\okayfreedom\openvpn64\tap0901.cat
%ProgramFiles(x86)%\okayfreedom\openvpn64\tap0901.sys
%ProgramFiles(x86)%\okayfreedom\openvpn64\xp\oemwin2k.inf
%ProgramFiles(x86)%\okayfreedom\openvpn64\xp\tap0901.cat
%ProgramFiles(x86)%\okayfreedom\openvpn64\xp\tap0901.sys
%CommonProgramFiles(x86)%\steganos\certificates\steganosproductsv2.crt
%ProgramFiles(x86)%\okayfreedom\manifest.json
%ProgramFiles(x86)%\okayfreedom\openvpn\addtap.bat
%ProgramFiles(x86)%\okayfreedom\openvpn\deltapall.bat
%ProgramFiles(x86)%\okayfreedom\openvpn64\addtap.bat
%TEMP%\nsrea6e.tmp\modern-header.bmp
%ProgramFiles(x86)%\okayfreedom\openvpn64\oemvista.inf
%ProgramFiles(x86)%\okayfreedom\infohelper.exe
%APPDATA%\steganos\okayfreedom\green.png
%APPDATA%\steganos\okayfreedom\red.png
%APPDATA%\steganos\okayfreedom\okf_license_expired_jp.jpg
%ProgramFiles(x86)%\okayfreedom\openvpn\ssleay32.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\libpkcs11-helper-1.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\msvcp60.dll
%APPDATA%\steganos\okf_servers.orig.xml
%ProgramFiles(x86)%\okayfreedom\resetpendingmoves.exe
%APPDATA%\steganos\okayfreedom\okf_traffic_90pc_jp.png
%APPDATA%\steganos\okayfreedom\okf_license_3days_jp.jpg
%APPDATA%\steganos\okayfreedom\okf_connect_de.png
%ProgramFiles(x86)%\okayfreedom\openvpn64\msvcr71.dll
%APPDATA%\steganos\okayfreedom\okf_traffic_100mb_de.png
%ProgramFiles(x86)%\okayfreedom\vpn.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\up.cmd
%APPDATA%\steganos\okayfreedom\blue.png
%ProgramFiles(x86)%\okayfreedom\openvpn\readme
%ProgramFiles(x86)%\okayfreedom\openvpn\msvcr71.dll
%ProgramFiles(x86)%\okayfreedom\openvpn\changesinopenvpn23.txt
%ProgramFiles(x86)%\okayfreedom\openvpn\devcon.exe
%ProgramFiles(x86)%\okayfreedom\openvpn\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\okayfreedom\openvpn64\tapinstall.exe
%ProgramFiles(x86)%\okayfreedom\openvpn64\openssl.exe
%APPDATA%\steganos\okayfreedom\okf_license_3days_en.jpg
%ProgramFiles(x86)%\okayfreedom\openvpn\up.cmd
%ProgramFiles(x86)%\okayfreedom\openvpn64\license.txt
%ProgramFiles(x86)%\okayfreedom\openvpn\install-win32.txt
%ProgramFiles(x86)%\okayfreedom\dict\r\a
%ProgramFiles(x86)%\okayfreedom\openvpn64\tap-windows.exe
%ProgramFiles(x86)%\okayfreedom\openvpn64\readme
%APPDATA%\steganos\okayfreedom\okf_packshot.png
%APPDATA%\steganos\okayfreedom\okf_traffic_90pc_en.png
%ProgramFiles(x86)%\okayfreedom\openvpn64\changesinopenvpn23.txt
%APPDATA%\steganos\okayfreedom\orange.png
%APPDATA%\steganos\okayfreedom\okf_traffic_exceeded_de.png
%APPDATA%\steganos\okayfreedom\okf_license_expired_en.jpg
%APPDATA%\steganos\okayfreedom\okf_connect_en.png
%ProgramFiles(x86)%\okayfreedom\openvpn64\liblzo2-2.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\install-win32.txt
%APPDATA%\steganos\okayfreedom\okf_traffic_100mb_en.png
%APPDATA%\steganos\okayfreedom\okf_template_new.htm
%ProgramFiles(x86)%\okayfreedom\openvpn\xp\tap0901.cat
%ProgramFiles(x86)%\okayfreedom\openvpn\msvcr90.dll
%ProgramFiles(x86)%\okayfreedom\openvpn64\ssleay32.dll
%APPDATA%\steganos\okayfreedom\okf_license_3days_de.jpg
%APPDATA%\steganos\okayfreedom\okf_connect_jp.png
%ProgramFiles(x86)%\okayfreedom\openvpn64\lzo2.dll
%ProgramFiles(x86)%\okayfreedom\openvpn\tap-windows.exe
%ProgramFiles(x86)%\okayfreedom\openvpn64\libeay32.dll
%ProgramFiles(x86)%\okayfreedom\openvpn\license.txt
%ProgramFiles(x86)%\okayfreedom\openvpn\libeay32.dll
%APPDATA%\steganos\okayfreedom\okf_traffic_90pc_de.png
%APPDATA%\steganos\okayfreedom\okf_traffic_100mb_jp.png
%ProgramFiles(x86)%\okayfreedom\openvpn\openssl.exe
%ProgramFiles(x86)%\okayfreedom\setuptool.exe
%ProgramFiles(x86)%\okayfreedom\dict\s\i
%ProgramFiles(x86)%\okayfreedom\dict\r\c
%ProgramFiles(x86)%\okayfreedom\dict\b\b
%ProgramFiles(x86)%\okayfreedom\dict\f\z
%ProgramFiles(x86)%\okayfreedom\dict\f\q
%ProgramFiles(x86)%\okayfreedom\dict\f\p
%ProgramFiles(x86)%\okayfreedom\dict\f\s
%ProgramFiles(x86)%\okayfreedom\dict\f\r
%ProgramFiles(x86)%\okayfreedom\dict\f\u
%ProgramFiles(x86)%\okayfreedom\dict\f\t
%ProgramFiles(x86)%\okayfreedom\dict\f\w
%ProgramFiles(x86)%\okayfreedom\dict\f\v
%ProgramFiles(x86)%\okayfreedom\dict\f\d
%ProgramFiles(x86)%\okayfreedom\dict\f\i
%ProgramFiles(x86)%\okayfreedom\dict\f\k
%ProgramFiles(x86)%\okayfreedom\dict\f\j
%ProgramFiles(x86)%\okayfreedom\dict\f\m
%ProgramFiles(x86)%\okayfreedom\dict\f\l
%ProgramFiles(x86)%\okayfreedom\dict\f\o
%ProgramFiles(x86)%\okayfreedom\dict\f\n
%ProgramFiles(x86)%\okayfreedom\dict\f\a
%ProgramFiles(x86)%\okayfreedom\dict\f\c
%ProgramFiles(x86)%\okayfreedom\dict\f\b
%ProgramFiles(x86)%\okayfreedom\dict\b\c
%ProgramFiles(x86)%\okayfreedom\dict\b\a
%ProgramFiles(x86)%\okayfreedom\dict\f\h
%ProgramFiles(x86)%\okayfreedom\dict\f\x
%ProgramFiles(x86)%\okayfreedom\dict\f\y
%ProgramFiles(x86)%\okayfreedom\dict\b\f
%ProgramFiles(x86)%\okayfreedom\dict\b\g
%ProgramFiles(x86)%\okayfreedom\dict\b\y
%ProgramFiles(x86)%\okayfreedom\dict\b\x
%ProgramFiles(x86)%\okayfreedom\dict\b\z
%ProgramFiles(x86)%\okayfreedom\dict\b\u
%ProgramFiles(x86)%\okayfreedom\dict\b\t
%ProgramFiles(x86)%\okayfreedom\dict\b\w
%ProgramFiles(x86)%\okayfreedom\dict\b\v
%ProgramFiles(x86)%\okayfreedom\dict\b\q
%ProgramFiles(x86)%\okayfreedom\dict\f\e
%ProgramFiles(x86)%\okayfreedom\dict\b\p
%ProgramFiles(x86)%\okayfreedom\dict\b\r
%ProgramFiles(x86)%\okayfreedom\dict\f\g
%ProgramFiles(x86)%\okayfreedom\dict\b\m
%ProgramFiles(x86)%\okayfreedom\dict\b\o
%ProgramFiles(x86)%\okayfreedom\dict\b\n
%ProgramFiles(x86)%\okayfreedom\dict\b\i
%ProgramFiles(x86)%\okayfreedom\dict\b\h
%ProgramFiles(x86)%\okayfreedom\dict\b\k
%ProgramFiles(x86)%\okayfreedom\dict\b\j
%ProgramFiles(x86)%\okayfreedom\dict\b\e
%ProgramFiles(x86)%\okayfreedom\dict\b\d
%ProgramFiles(x86)%\okayfreedom\dict\b\s
%ProgramFiles(x86)%\okayfreedom\dict\t\m
%ProgramFiles(x86)%\okayfreedom\dict\t\n
%ProgramFiles(x86)%\okayfreedom\dict\b\l
%ProgramFiles(x86)%\okayfreedom\dict\f\f
%ProgramFiles(x86)%\okayfreedom\dict\n\c
%ProgramFiles(x86)%\okayfreedom\dict\j\e
%ProgramFiles(x86)%\okayfreedom\dict\n\e
%ProgramFiles(x86)%\okayfreedom\dict\n\d
%ProgramFiles(x86)%\okayfreedom\dict\n\g
%ProgramFiles(x86)%\okayfreedom\dict\n\f
%ProgramFiles(x86)%\okayfreedom\dict\n\i
%ProgramFiles(x86)%\okayfreedom\dict\n\h
%ProgramFiles(x86)%\okayfreedom\dict\n\k
%ProgramFiles(x86)%\okayfreedom\dict\n\j
%ProgramFiles(x86)%\okayfreedom\dict\n\m
%ProgramFiles(x86)%\okayfreedom\dict\n\a
%ProgramFiles(x86)%\okayfreedom\dict\j\z
%ProgramFiles(x86)%\okayfreedom\dict\n\b
%ProgramFiles(x86)%\okayfreedom\dict\n\l
%ProgramFiles(x86)%\okayfreedom\dict\n\p
%ProgramFiles(x86)%\okayfreedom\dict\n\s
%ProgramFiles(x86)%\okayfreedom\dict\n\r
%ProgramFiles(x86)%\okayfreedom\dict\n\u
%ProgramFiles(x86)%\okayfreedom\dict\n\t
%ProgramFiles(x86)%\okayfreedom\dict\n\w
%ProgramFiles(x86)%\okayfreedom\dict\n\v
%ProgramFiles(x86)%\okayfreedom\dict\n\y
%ProgramFiles(x86)%\okayfreedom\dict\n\x
%ProgramFiles(x86)%\okayfreedom\dict\n\o
%ProgramFiles(x86)%\okayfreedom\dict\n\n
%ProgramFiles(x86)%\okayfreedom\dict\n\q
%ProgramFiles(x86)%\okayfreedom\dict\t\l
%ProgramFiles(x86)%\okayfreedom\dict\t\o
%ProgramFiles(x86)%\okayfreedom\dict\t\i
%ProgramFiles(x86)%\okayfreedom\dict\j\d
%ProgramFiles(x86)%\okayfreedom\dict\j\g
%ProgramFiles(x86)%\okayfreedom\dict\j\f
%ProgramFiles(x86)%\okayfreedom\dict\j\a
%ProgramFiles(x86)%\okayfreedom\dict\j\c
%ProgramFiles(x86)%\okayfreedom\dict\j\b
%ProgramFiles(x86)%\okayfreedom\dict\j\m
%ProgramFiles(x86)%\okayfreedom\dict\j\l
%ProgramFiles(x86)%\okayfreedom\dict\j\o
%ProgramFiles(x86)%\okayfreedom\dict\j\x
%ProgramFiles(x86)%\okayfreedom\dict\o\w
%ProgramFiles(x86)%\okayfreedom\dict\j\y
%ProgramFiles(x86)%\okayfreedom\dict\j\n
%ProgramFiles(x86)%\okayfreedom\dict\j\j
%ProgramFiles(x86)%\okayfreedom\dict\j\u
%ProgramFiles(x86)%\okayfreedom\dict\j\t
%ProgramFiles(x86)%\okayfreedom\dict\j\w
%ProgramFiles(x86)%\okayfreedom\dict\j\v
%ProgramFiles(x86)%\okayfreedom\dict\j\q
%ProgramFiles(x86)%\okayfreedom\dict\j\p
%ProgramFiles(x86)%\okayfreedom\dict\j\s
%ProgramFiles(x86)%\okayfreedom\dict\j\r
%ProgramFiles(x86)%\okayfreedom\dict\j\i
%ProgramFiles(x86)%\okayfreedom\dict\j\h
%ProgramFiles(x86)%\okayfreedom\dict\j\k
%ProgramFiles(x86)%\okayfreedom\dict\t\h
%ProgramFiles(x86)%\okayfreedom\dict\t\j
%ProgramFiles(x86)%\okayfreedom\dict\r\b
%ProgramFiles(x86)%\okayfreedom\dict\v\p
%ProgramFiles(x86)%\okayfreedom\dict\v\s
%ProgramFiles(x86)%\okayfreedom\dict\v\r
%ProgramFiles(x86)%\okayfreedom\dict\v\u
%ProgramFiles(x86)%\okayfreedom\dict\v\t
%ProgramFiles(x86)%\okayfreedom\dict\v\w
%ProgramFiles(x86)%\okayfreedom\dict\v\v
%ProgramFiles(x86)%\okayfreedom\dict\x\z
%ProgramFiles(x86)%\okayfreedom\dict\x\y
%ProgramFiles(x86)%\okayfreedom\dict\v\x
%ProgramFiles(x86)%\okayfreedom\dict\v\h
%ProgramFiles(x86)%\okayfreedom\dict\v\q
%ProgramFiles(x86)%\okayfreedom\dict\x\x
%ProgramFiles(x86)%\okayfreedom\dict\x\t
%ProgramFiles(x86)%\okayfreedom\dict\x\s
%ProgramFiles(x86)%\okayfreedom\dict\x\r
%ProgramFiles(x86)%\okayfreedom\dict\x\q
%ProgramFiles(x86)%\okayfreedom\dict\x\p
%ProgramFiles(x86)%\okayfreedom\dict\x\o
%ProgramFiles(x86)%\okayfreedom\dict\x\n
%ProgramFiles(x86)%\okayfreedom\dict\x\m
%ProgramFiles(x86)%\okayfreedom\dict\x\l
%ProgramFiles(x86)%\okayfreedom\dict\x\w
%ProgramFiles(x86)%\okayfreedom\dict\x\v
%ProgramFiles(x86)%\okayfreedom\dict\x\u
%APPDATA%\steganos\res\bmp_flag_uk64.png
%ProgramFiles(x86)%\okayfreedom\dict\x\k
%ProgramFiles(x86)%\okayfreedom\dict\v\g
%ProgramFiles(x86)%\okayfreedom\dict\r\x
%ProgramFiles(x86)%\okayfreedom\dict\r\z
%ProgramFiles(x86)%\okayfreedom\dict\r\u
%ProgramFiles(x86)%\okayfreedom\dict\r\t
%ProgramFiles(x86)%\okayfreedom\dict\r\w
%ProgramFiles(x86)%\okayfreedom\dict\r\v
%ProgramFiles(x86)%\okayfreedom\dict\r\q
%ProgramFiles(x86)%\okayfreedom\dict\r\p
%ProgramFiles(x86)%\okayfreedom\dict\r\s
%ProgramFiles(x86)%\okayfreedom\dict\r\r
%ProgramFiles(x86)%\okayfreedom\dict\v\f
%ProgramFiles(x86)%\okayfreedom\dict\v\y
%ProgramFiles(x86)%\okayfreedom\dict\v\i
%ProgramFiles(x86)%\okayfreedom\dict\v\j
%ProgramFiles(x86)%\okayfreedom\dict\v\m
%ProgramFiles(x86)%\okayfreedom\dict\v\l
%ProgramFiles(x86)%\okayfreedom\dict\v\o
%ProgramFiles(x86)%\okayfreedom\dict\v\n
%ProgramFiles(x86)%\okayfreedom\dict\v\a
%ProgramFiles(x86)%\okayfreedom\dict\v\c
%ProgramFiles(x86)%\okayfreedom\dict\v\b
%ProgramFiles(x86)%\okayfreedom\dict\v\e
%ProgramFiles(x86)%\okayfreedom\dict\v\d
%ProgramFiles(x86)%\okayfreedom\dict\r\y
%ProgramFiles(x86)%\okayfreedom\dict\v\k
%APPDATA%\steganos\res\bmp_flag_ru_checked16.png
%ProgramFiles(x86)%\okayfreedom\dict\x\j
%ProgramFiles(x86)%\okayfreedom\dict\x\g
%ProgramFiles(x86)%\okayfreedom\dict\p\k
%ProgramFiles(x86)%\okayfreedom\dict\p\j
%ProgramFiles(x86)%\okayfreedom\dict\p\i
%ProgramFiles(x86)%\okayfreedom\dict\p\h
%ProgramFiles(x86)%\okayfreedom\dict\t\s
%ProgramFiles(x86)%\okayfreedom\dict\t\r
%ProgramFiles(x86)%\okayfreedom\dict\t\q
%ProgramFiles(x86)%\okayfreedom\dict\t\p
%ProgramFiles(x86)%\okayfreedom\dict\t\w
%ProgramFiles(x86)%\okayfreedom\dict\t\v
%ProgramFiles(x86)%\okayfreedom\dict\x\i
%ProgramFiles(x86)%\okayfreedom\dict\p\l
%ProgramFiles(x86)%\okayfreedom\dict\p\m
%ProgramFiles(x86)%\okayfreedom\dict\t\y
%ProgramFiles(x86)%\okayfreedom\dict\t\x
%ProgramFiles(x86)%\okayfreedom\dict\t\c
%ProgramFiles(x86)%\okayfreedom\dict\t\b
%ProgramFiles(x86)%\okayfreedom\dict\t\a
%ProgramFiles(x86)%\okayfreedom\dict\t\g
%ProgramFiles(x86)%\okayfreedom\dict\t\f
%ProgramFiles(x86)%\okayfreedom\dict\t\e
%ProgramFiles(x86)%\okayfreedom\dict\t\d
%ProgramFiles(x86)%\okayfreedom\dict\t\k
%ProgramFiles(x86)%\okayfreedom\dict\t\u
%ProgramFiles(x86)%\okayfreedom\dict\t\z
%ProgramFiles(x86)%\okayfreedom\dict\x\h
%ProgramFiles(x86)%\okayfreedom\dict\t\t
%ProgramFiles(x86)%\okayfreedom\dict\v\z
%ProgramFiles(x86)%\okayfreedom\dict\x\f
%ProgramFiles(x86)%\okayfreedom\dict\x\e
%ProgramFiles(x86)%\okayfreedom\dict\x\d
%ProgramFiles(x86)%\okayfreedom\dict\x\c
%ProgramFiles(x86)%\okayfreedom\dict\x\b
%ProgramFiles(x86)%\okayfreedom\dict\x\a
%ProgramFiles(x86)%\okayfreedom\dict\p\w
%ProgramFiles(x86)%\okayfreedom\dict\p\v
%ProgramFiles(x86)%\okayfreedom\dict\p\u
%ProgramFiles(x86)%\okayfreedom\dict\p\t
%ProgramFiles(x86)%\okayfreedom\dict\p\a
%ProgramFiles(x86)%\okayfreedom\dict\p\n
%ProgramFiles(x86)%\okayfreedom\dict\p\o
%ProgramFiles(x86)%\okayfreedom\dict\p\p
%ProgramFiles(x86)%\okayfreedom\dict\p\z
%ProgramFiles(x86)%\okayfreedom\dict\p\y
%ProgramFiles(x86)%\okayfreedom\dict\p\x
%ProgramFiles(x86)%\okayfreedom\dict\p\g
%ProgramFiles(x86)%\okayfreedom\dict\p\f
%ProgramFiles(x86)%\okayfreedom\dict\p\e
%ProgramFiles(x86)%\okayfreedom\dict\p\d
%ProgramFiles(x86)%\okayfreedom\dict\p\c
%ProgramFiles(x86)%\okayfreedom\dict\p\b
%ProgramFiles(x86)%\okayfreedom\dict\p\s
%ProgramFiles(x86)%\okayfreedom\dict\p\q
%APPDATA%\steganos\res\bmp_flag_us64.png

Deletes the following files

%TEMP%\nsrea6e.tmp\dumplog.dll
%TEMP%\nsrea6e.tmp\modern-header.bmp
%TEMP%\nsrea6e.tmp\nsexec.dll
%TEMP%\nsrea6e.tmp\processes.dll
%TEMP%\nsrea6e.tmp\simplesc.dll
%TEMP%\nsrea6e.tmp\system.dll
%TEMP%\nsrea6e.tmp\uac.dll

Substitutes the following files

%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\extensions.json

Network activity

Connects to

'ok###reedom.com':443
'st###nos.com':443
'vp##.#teganos.com':443
'ba#####.steganos.com':443
'ap#.##eganos.com':443
'dj#.##eganos.com':443
'microsoft.com':80
'vp#.##ayfreedom.com':443

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'ok###reedom.com':443
'st###nos.com':443
'vp##.#teganos.com':443
'ba#####.steganos.com':443
'ap#.##eganos.com':443
'dj#.##eganos.com':443

UDP

DNS ASK ok###reedom.com
DNS ASK dj#.##eganos.com
DNS ASK ba#####.steganos.com
DNS ASK sm#####l.t-online.de
DNS ASK sm##.web.de
DNS ASK sm##.#odafone.de
DNS ASK sm##.#ersatel.de
DNS ASK sm##.#ail.yahoo.com
DNS ASK sm##.mail.de
DNS ASK sm##.#abelmail.de
DNS ASK sm##.gmail.com
DNS ASK microsoft.com
DNS ASK sm##.de.aol.com
DNS ASK sm#####il.outlook.com
DNS ASK se#####mtp.t-online.de
DNS ASK mx.##eenet.de
DNS ASK ma##.#2online.de
DNS ASK ma##.gmx.net
DNS ASK ma##.epost.de
DNS ASK ma##.arcor.de
DNS ASK vp##.#teganos.com
DNS ASK ap#.##eganos.com
DNS ASK st###nos.com
DNS ASK sm##.1und1.de
DNS ASK vp#.##ayfreedom.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '' WindowName: 'Digital Signature Not Found'

Creates and executes the following

'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' hwids tap0901
'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' remove tap0901
'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' remove TAPDEV
'%ProgramFiles(x86)%\okayfreedom\okayfreedomclient.exe' -install
'%ProgramFiles(x86)%\okayfreedom\okayfreedomservice.exe'
'%ProgramFiles(x86)%\okayfreedom\notifier.exe'
'%ProgramFiles(x86)%\okayfreedom\resetpendingmoves.exe' "OkayFreedom"
'%ProgramFiles(x86)%\okayfreedom\updater.exe' --showthankyou
'%ProgramFiles(x86)%\okayfreedom\okayfreedomclient.exe'
'%ProgramFiles(x86)%\okayfreedom\updater.exe' --verbosity silent
'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' hwids tap0901' (with hidden window)
'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' remove tap0901' (with hidden window)
'%ProgramFiles(x86)%\okayfreedom\openvpn64\devcon.exe' remove TAPDEV' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial