phpMyAdmin Multiple Vulnerabilities

Multiple vulnerabilities have been identified in phpMyAdmin, a remote attacker can exploit these vulnerabilities to trigger remote code execution and sensitive information disclosure on the targeted system.

  • Remote Code Execution
  • Information Disclosure

Before installation of the software, please visit the software manufacturer web-site for more details.

  • Update to version 4.8.5
  • CVE-2019-6798
  • CVE-2019-6799

Cisco Products Multiple Vulnerabilities

Multiple vulnerabilities were identified in Cisco products, a remote attacker can exploit these vulnerabilities to trigger cross site scripting, denial of service condition, elevation of privilege, bypass security restriction and disclose sensitive information on the targeted system.

  • Cross-Site Scripting
  • Denial of Service
  • Elevation of Privilege
  • Security Restriction Bypass
  • Information Disclosure
  • Cisco Firepower Management Center
  • Cisco Identity Services Engine
  • Cisco SD-WAN Solution
  • Cisco Webex

For other Cisco Products, please refer to the link below:
https://tools.cisco.com/security/center/publicationListing.x

Before installation of the software, please visit the software manufacturer web-site for more details.

PUA.LiteSurf

Updated: January 31, 2019 9:56:35 AM
Type: Potentially Unwanted App
Infection Length: Varies
Name: LiteSurf.com – client
Publisher: Litesurf.com
Risk Impact: Medium
Systems Affected: Windows

Behavior

PUA.LiteSurf is a potentially unwanted application that may be used for online advertising to generate revenue.

Updated: January 31, 2019 9:56:35 AM
Type: Potentially Unwanted App
Infection Length: Varies
Name: LiteSurf.com – client
Publisher: Litesurf.com
Risk Impact: Medium
Systems Affected: Windows

When the application is installed, it creates the following folders:

  • %ProgramFiles%\LiteSurf.com – client\chrome
  • %ProgramFiles%\LiteSurf.com – client\components
  • %ProgramFiles%\LiteSurf.com – client\defaults
  • %ProgramFiles%\LiteSurf.com – client\dictionaries
  • %ProgramFiles%\LiteSurf.com – client\modules
  • %ProgramFiles%\LiteSurf.com – client\plugins
  • %ProgramFiles%\LiteSurf.com – client\res
  • %ProgramFiles%\LiteSurf.com – client\defaults\autoconfig
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\US
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\US\chrome
  • %ProgramFiles%\LiteSurf.com – client\res\download
  • %ProgramFiles%\LiteSurf.com – client\res\dtd
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables
  • %ProgramFiles%\LiteSurf.com – client\res\fonts
  • %ProgramFiles%\LiteSurf.com – client\res\html

The application then creates the following files:

  • %ProgramFiles%\LiteSurf.com – client\AccessibleMarshal.dll
  • %ProgramFiles%\LiteSurf.com – client\freebl3.chk
  • %ProgramFiles%\LiteSurf.com – client\freebl3.dll
  • %ProgramFiles%\LiteSurf.com – client\greprefs
  • %ProgramFiles%\LiteSurf.com – client\IA2Marshal.dll
  • %ProgramFiles%\LiteSurf.com – client\javaxpcom.jar
  • %ProgramFiles%\LiteSurf.com – client\javaxpcomglue.dll
  • %ProgramFiles%\LiteSurf.com – client\js3250.dll
  • %ProgramFiles%\LiteSurf.com – client\LiteSURF.exe
  • %ProgramFiles%\LiteSurf.com – client\mozcrt19.dll
  • %ProgramFiles%\LiteSurf.com – client\mozctl.dll
  • %ProgramFiles%\LiteSurf.com – client\mozctlx.dll
  • %ProgramFiles%\LiteSurf.com – client\msacm32.dll
  • %ProgramFiles%\LiteSurf.com – client\nspr4.dll
  • %ProgramFiles%\LiteSurf.com – client\nss3.dll
  • %ProgramFiles%\LiteSurf.com – client\nssckbi.dll
  • %ProgramFiles%\LiteSurf.com – client\nssdbm3.chk
  • %ProgramFiles%\LiteSurf.com – client\nssdbm3.dll
  • %ProgramFiles%\LiteSurf.com – client\nssutil3.dll
  • %ProgramFiles%\LiteSurf.com – client\plc4.dll
  • %ProgramFiles%\LiteSurf.com – client\plds4.dll
  • %ProgramFiles%\LiteSurf.com – client\smime3.dll
  • %ProgramFiles%\LiteSurf.com – client\softokn3.chk
  • %ProgramFiles%\LiteSurf.com – client\softokn3.dll
  • %ProgramFiles%\LiteSurf.com – client\sqlite3.dll
  • %ProgramFiles%\LiteSurf.com – client\ssl3.dll
  • %ProgramFiles%\LiteSurf.com – client\unins000.dat
  • %ProgramFiles%\LiteSurf.com – client\unins000.exe
  • %ProgramFiles%\LiteSurf.com – client\xpcom.dll
  • %ProgramFiles%\LiteSurf.com – client\xul.dll
  • %ProgramFiles%\LiteSurf.com – client\xum.dll
  • %ProgramFiles%\LiteSurf.com – client\chrome\classic.jar
  • %ProgramFiles%\LiteSurf.com – client\chrome\classic.manifest
  • %ProgramFiles%\LiteSurf.com – client\chrome\comm.jar
  • %ProgramFiles%\LiteSurf.com – client\chrome\comm.manifest
  • %ProgramFiles%\LiteSurf.com – client\chrome\en-US.jar
  • %ProgramFiles%\LiteSurf.com – client\chrome\en-US.manifest
  • %ProgramFiles%\LiteSurf.com – client\chrome\pippki.jar
  • %ProgramFiles%\LiteSurf.com – client\chrome\pippki.manifest
  • %ProgramFiles%\LiteSurf.com – client\chrome\toolkit.jar
  • %ProgramFiles%\LiteSurf.com – client\chrome\toolkit.manifest
  • %ProgramFiles%\LiteSurf.com – client\components\accessibility-msaa.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\accessibility.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\alerts.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\appshell.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\appstartup.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\autocomplete.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\autoconfig.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\caps.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\chardet.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\chrome.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\commandhandler.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\commandlines.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\composer.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\compreg.dat
  • %ProgramFiles%\LiteSurf.com – client\components\contentprefs.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_html.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_htmldoc.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_xmldoc.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_xslt.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\content_xtf.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\cookie.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\directory.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\docshell_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_canvas.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_core.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_css.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_events.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_geolocation.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_html.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_json.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_loadsave.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_offline.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_range.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_sidebar.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_storage.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_stylesheets.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_svg.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_threads.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_traversal.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_views.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_xbl.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_xpath.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\dom_xul.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\downloads.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\editor.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\embed_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\extensions.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\exthandler.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\exthelper.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\fastfind.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\FeedProcessor.js
  • %ProgramFiles%\LiteSurf.com – client\components\feeds.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\find.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\gfx.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\htmlparser.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\imgicon.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\imglib2.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\inspector.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\intl.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\jar.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\jsconsole-clhandler.js
  • %ProgramFiles%\LiteSurf.com – client\components\jsdservice.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\layout_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\layout_printing.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\layout_xul.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\layout_xul_tree.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\locale.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\loginmgr.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\lwbrk.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\mimetype.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\mozbrwsr.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\mozfind.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_about.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_cache.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_cookie.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_dns.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_file.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_ftp.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_http.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_res.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_socket.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_strconv.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_viewsource.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\necko_wifi.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\NetworkGeolocationProvider.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsAddonRepository.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsBadCertHandler.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsBlocklistService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsContentDispatchChooser.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsContentPrefService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsDefaultCLH.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsDownloadManagerUI.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsExtensionManager.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsHandlerService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsHelperAppDlg.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsLivemarkService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsLoginInfo.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsLoginManager.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsLoginManagerPrompter.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsPlacesDBFlush.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsPostUpdateWin.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsProgressDialog.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsProxyAutoConfig.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsSearchService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsSearchSuggestions.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsTaggingService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsTryToClose.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsUpdateService.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsURLFormatter.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsWebHandlerApp.js
  • %ProgramFiles%\LiteSurf.com – client\components\nsXULAppInstall.js
  • %ProgramFiles%\LiteSurf.com – client\components\oji.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\parentalcontrols.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\pipboot.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\pipnss.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\pippki.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\places.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\plugin.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\pluginGlue.js
  • %ProgramFiles%\LiteSurf.com – client\components\pref.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\prefetch.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\profile.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\proxyObject.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\rdf.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\satchel.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\saxparser.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\shistory.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\spellchecker.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\storage-Legacy.js
  • %ProgramFiles%\LiteSurf.com – client\components\storage-mozStorage.js
  • %ProgramFiles%\LiteSurf.com – client\components\storage.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\toolkitprofile.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\toolkitsearch.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\txEXSLTRegExFunctions.js
  • %ProgramFiles%\LiteSurf.com – client\components\txmgr.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\txtsvc.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\uconv.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\unicharutil.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\update.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\uriloader.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\urlformatter.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\webbrowserpersist.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\webBrowser_core.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\webshell_idls.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\widget.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\windowds.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\windowwatcher.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_base.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_components.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_ds.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_io.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_system.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_thread.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpcom_xpti.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpconnect.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpinstall.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xpti.dat
  • %ProgramFiles%\LiteSurf.com – client\components\xulapp.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xulapp_setup.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xuldoc.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\xultmpl.xpt
  • %ProgramFiles%\LiteSurf.com – client\components\zipwriter.xpt
  • %ProgramFiles%\LiteSurf.com – client\defaults\autoconfig\platform.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\autoconfig\prefcalls.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\channel-prefs.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\firefox-branding.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\firefox-l10n.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\firefox.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\reporter.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\pref\xulrunner.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\chrome
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\localstore.rdf
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\prefs.js
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\userContent.css
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\chrome\userChrome-example.css
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\chrome\userContent-example.css
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\US\localstore.rdf
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\US\chrome\userChrome-example.css
  • %ProgramFiles%\LiteSurf.com – client\defaults\profile\US\chrome\userContent-example.css
  • %ProgramFiles%\LiteSurf.com – client\dictionaries\en-US.aff
  • %ProgramFiles%\LiteSurf.com – client\dictionaries\en-US.dic
  • %ProgramFiles%\LiteSurf.com – client\greprefs\all.js
  • %ProgramFiles%\LiteSurf.com – client\greprefs\security-prefs.js
  • %ProgramFiles%\LiteSurf.com – client\greprefs\user-prefs.js
  • %ProgramFiles%\LiteSurf.com – client\greprefs\xpinstall.js
  • %ProgramFiles%\LiteSurf.com – client\modules\debug.js
  • %ProgramFiles%\LiteSurf.com – client\modules\DownloadLastDir.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\DownloadUtils.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\ISO8601DateUtils.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\Microformats.js
  • %ProgramFiles%\LiteSurf.com – client\modules\PlacesDBUtils.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\PluralForm.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\SpatialNavigation.js
  • %ProgramFiles%\LiteSurf.com – client\modules\utils.js
  • %ProgramFiles%\LiteSurf.com – client\modules\WindowDraggingUtils.jsm
  • %ProgramFiles%\LiteSurf.com – client\modules\XPCOMUtils.jsm
  • %ProgramFiles%\LiteSurf.com – client\plugins\flashplayer.xpt
  • %ProgramFiles%\LiteSurf.com – client\plugins\npnul32.dll
  • %ProgramFiles%\LiteSurf.com – client\plugins\NPSWF32.dll
  • %ProgramFiles%\LiteSurf.com – client\res\arrow.gif
  • %ProgramFiles%\LiteSurf.com – client\res\arrowd.gif
  • %ProgramFiles%\LiteSurf.com – client\res\broken-image.gif
  • %ProgramFiles%\LiteSurf.com – client\res\charsetalias.properties
  • %ProgramFiles%\LiteSurf.com – client\res\charsetData.properties
  • %ProgramFiles%\LiteSurf.com – client\res\contenteditable.css
  • %ProgramFiles%\LiteSurf.com – client\res\designmode.css
  • %ProgramFiles%\LiteSurf.com – client\res\EditorOverride.css
  • %ProgramFiles%\LiteSurf.com – client\res\forms.css
  • %ProgramFiles%\LiteSurf.com – client\res\grabber.gif
  • %ProgramFiles%\LiteSurf.com – client\res\hiddenWindow.html
  • %ProgramFiles%\LiteSurf.com – client\res\html.css
  • %ProgramFiles%\LiteSurf.com – client\res\index.html
  • %ProgramFiles%\LiteSurf.com – client\res\langGroups.properties
  • %ProgramFiles%\LiteSurf.com – client\res\language.properties
  • %ProgramFiles%\LiteSurf.com – client\res\loading-image.gif
  • %ProgramFiles%\LiteSurf.com – client\res\mathml.css
  • %ProgramFiles%\LiteSurf.com – client\res\quirk.css
  • %ProgramFiles%\LiteSurf.com – client\res\svg.css
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-after-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-after-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-after.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-before-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-before-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-column-before.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-after-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-after-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-after.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-before-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-before-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-add-row-before.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-column-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-column-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-column.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-row-active.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-row-hover.gif
  • %ProgramFiles%\LiteSurf.com – client\res\table-remove-row.gif
  • %ProgramFiles%\LiteSurf.com – client\res\ua.css
  • %ProgramFiles%\LiteSurf.com – client\res\Update.exe
  • %ProgramFiles%\LiteSurf.com – client\res\viewsource.css
  • %ProgramFiles%\LiteSurf.com – client\res\wincharset.properties
  • %ProgramFiles%\LiteSurf.com – client\res\download\update.zip
  • %ProgramFiles%\LiteSurf.com – client\res\dtd\mathml.dtd
  • %ProgramFiles%\LiteSurf.com – client\res\dtd\xhtml11.dtd
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\html40Latin1.properties
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\html40Special.properties
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\html40Symbols.properties
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\htmlEntityVersions.properties
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\mathml20.properties
  • %ProgramFiles%\LiteSurf.com – client\res\entityTables\transliterate.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfont.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfontStandardSymbolsL.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfontSTIXNonUnicode.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfontSTIXSize1.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfontSymbol.properties
  • %ProgramFiles%\LiteSurf.com – client\res\fonts\mathfontUnicode.properties
  • %ProgramFiles%\LiteSurf.com – client\res\html\folder.png

Next, the application creates the following registry subkey:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1

The application then creates the following registry entries:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”Inno Setup: Setup Version” = “5.4.3 (a)”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”Inno Setup: App Path” = “%ProgramFiles%\LiteSurf.com – client”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”InstallLocation” = “%ProgramFiles%\LiteSurf.com – client\”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”Inno Setup: Icon Group” = “LiteSurf.com – client”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”Inno Setup: User” = “test”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\Inno Setup: Language” = “ENG”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”DisplayName” = “LiteSurf.com – client version 3.0”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”UninstallString” = “”%ProgramFiles%\LiteSurf.com – client\unins000.exe””
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”QuietUninstallString” = “”%ProgramFiles%\LiteSurf.com – client\unins000.exe” /SILENT”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”DisplayVersion” = “3.0”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”URLInfoAbout” = “http://litesurf.com/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”HelpLink” = “http://litesurf.com/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”URLUpdateInfo” = “http://litesurf.com/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”NoModify” = “1”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”NoRepair” = “1”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”InstallDate” “20190128”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”MajorVersion” = “3”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”MinorVersion” = “0”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2988E41-0ADF-4751-B442-0F18B50FEA11}_is1\”EstimatedSize” = “82E”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\”Scan\ETWLastFailureUpdateTime” = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\%AllUsersProfile%\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LiteSurf.com – client\”LiteSurf.com – client.lnk” = “1”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\%ProgramData%\Microsoft\Windows\Start Menu\Programs\LiteSurf.com – client\”LiteSurf.com – client.lnk” = “1”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\grfg\Qrfxgbc\”p1npon1son884763p24158p06pr2s3q77n91o984o9rs58o4sq25r099r510q8so.rkr” = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Run\”LiteSurf” = “”%ProgramFiles%\LiteSurf.com – client\LiteSURF.exe” -start”

The application may be used for online advertising to generate revenue.

PUA.IpGoldSurf

Updated: January 30, 2019 6:51:20 AM
Type: Potentially Unwanted App
Infection Length: Varies
Risk Impact: Medium
Systems Affected: Windows

Behavior

PUA.IpGoldSurf is a potentially unwanted application that may be used for online advertising to generate revenue.

When the application is installed, it creates the following files:

  • %ProgramFiles%\IpGoldSurfer\d3dcompiler_43.dll
  • %ProgramFiles%\IpGoldSurfer\d3dcompiler_46.dll
  • %ProgramFiles%\IpGoldSurfer\d3dx9_43.dll
  • %ProgramFiles%\IpGoldSurfer\ffmpegsumo.dll
  • %ProgramFiles%\IpGoldSurfer\icudt.dll
  • %ProgramFiles%\IpGoldSurfer\ipgoldsurfer.cfg
  • %ProgramFiles%\IpGoldSurfer\ipgoldsurfer.exe
  • %ProgramFiles%\IpGoldSurfer\libcef.dll
  • %ProgramFiles%\IpGoldSurfer\libEGL.dll
  • %ProgramFiles%\IpGoldSurfer\libGLESv2.dll
  • %ProgramFiles%\IpGoldSurfer\ru.pak

The application may be used for online advertising to generate revenue. It lets users browse surfing sites, perform tasks for advertisers, and read advertising letters.
The application uses its own browser and is designed to work in the ipGold.ru service.

PUA.RedSurf

Updated: January 31, 2019 11:11:15 AM
Type: Potentially Unwanted App
Infection Length: Varies
Name: RedSurf-client
Version: 2.2.6.0
Publisher: Redsurf.ru
Risk Impact: Medium
Systems Affected: Windows

Behavior

PUA.RedSurf is a potentially unwanted application that may be used for online advertising to generate revenue.

When the application is installed, it creates the following folders:

  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\cache2
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\datareporting
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\gmp
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\tmp
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\cache2\doomed
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\cache2\entries
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\safebrowsing
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\startupCache
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\update
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\browser
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\chrome.manifest

The application then creates the following files:

  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\cfg.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\redsurf.exe
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\unins000.dat
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\unins000.exe
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\XulFx.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\XulFx.Windows.Forms.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\XulFx.xpi
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\cert8.db
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\key3.db
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\permissions.sqlite
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\places.sqlite
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\places.sqlite-shm
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\places.sqlite-wal
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\pluginreg.dat
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\secmod.db
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\times.json
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\datareporting\aborted-session-ping
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\datareporting\session-state.json
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\datareporting\state.json
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\profile_52\tmp\mozilla-temp-files
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\alt_red.png
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\no_connect.html
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\no_site.html
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\no_slot.html
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\no_wait.html
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\update\ICSharpCode.SharpZipLib.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\res\update\update.exe
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\Accessible.tlb
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\AccessibleMarshal.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-console-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-datetime-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-debug-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-errorhandling-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-file-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-file-l1-2-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-file-l2-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-handle-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-heap-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-interlocked-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-libraryloader-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-localization-l1-2-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-memory-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-namedpipe-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-processenvironment-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-processthreads-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-processthreads-l1-1-1.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-profile-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-string-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-synch-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-synch-l1-2-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-sysinfo-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-timezone-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-core-util-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-conio-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-convert-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-environment-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-filesystem-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-heap-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-locale-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-math-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-multibyte-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-private-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-process-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-runtime-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-stdio-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-string-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-time-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\api-ms-win-crt-utility-l1-1-0.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\application.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\breakpadinjector.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\crashreporter.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\D3DCompiler_43.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\d3dcompiler_47.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\dependentlibs.list
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\firefox.VisualElementsManifest.xml
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\freebl3.chk
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\freebl3.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\gmp-clearkey
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\IA2Marshal.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\lgpllibs.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\libEGL.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\libGLESv2.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\mozavcodec.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\mozavutil.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\mozglue.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\msvcp140.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\nss3.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\nssckbi.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\nssdbm3.chk
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\nssdbm3.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\omni.ja
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\platform.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\qipcap.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\removed-files
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\softokn3.chk
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\softokn3.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\ucrtbase.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\update-settings.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\updater.ini
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\vcruntime140.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\xul.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\gmp-clearkey\0.1
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\gmp-clearkey\0.1\clearkey.dll
  • %AllUsersProfile%\test\AppData\Roaming\RedSurf-client\xulrunner_52\gmp-clearkey\0.1\clearkey.info

Next, the application creates the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell

The application then creates the following registry entries:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”Inno Setup: Setup Version” = “5.5.9 (a)”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”Inno Setup: App Path” = “%AllUsersProfile%\test\AppData\Roaming\RedSurf-client”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”InstallLocation” = “%AllUsersProfile%\test\AppData\Roaming\RedSurf-client\”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”Inno Setup: Icon Group” = “RedSurf-client”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”Inno Setup: User” = “test”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”Inno Setup: Language: “russian”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”DisplayName: “RedSurf-client, âåðñèÿ 2.2.6”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”UninstallString: “”%AllUsersProfile%\test\AppData\Roaming\RedSurf-client\unins000.exe””
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”QuietUninstallString: “”%AllUsersProfile%\test\AppData\Roaming\RedSurf-client\unins000.exe” /SILENT”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”DisplayVersion: “2.2.6”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”URLInfoAbout: “http://redsurf.ru/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”HelpLink: “http://redsurf.ru/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”URLUpdateInfo” = “http://redsurf.ru/”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”NoModify” = “1”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”NoRepair” = “1”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”InstallDate” = “20190128”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”MajorVersion” = “2”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”MinorVersion” = “2”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”VersionMajor” = “2”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”VersionMinor” = “2”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC018B2D-6FB2-4E65-9366-425E255435EC}_is1\”EstimatedSize” = “13017”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\%AllUsersProfile%\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RedSurf-client\”RedSurf-client.lnk” = “1”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RedSurf-client\”RedSurf-client.lnk” = “1”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\grfg\Qrfxgbc\”erqfhes_frghc_i.2.2.6.rkr” = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Microsoft\Windows\CurrentVersion\Run\”redsurf” = “%AllUsersProfile%\test\AppData\Roaming\RedSurf-client\redsurf.exe -up”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Sysinternals\Process Monitor\”FilterDialog” = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Sysinternals\Process Monitor\”FilterControlColumns” = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\”1″ = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1\”NodeSlot” = “64”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1\”MRUListEx” = “FF FF FF FF”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell\”KnownFolderDerivedFolderType” = “{57807898-8C4F-4462-BB63-71042380B109}”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell\”SniffedFolderType” = “Generic”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\”1″ = “[HEXADECIMAL VALUE]”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1\”NodeSlot” = “64”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1\”MRUListEx” = “FF FF FF FF”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell\”KnownFolderDerivedFolderType” = “{57807898-8C4F-4462-BB63-71042380B109}”
  • HKEY_USERS\S-1-5-21-3087506387-2454565724-164994176-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\100\Shell\”SniffedFolderType” = “Generic”

The application may be used for online advertising to generate revenue.