The third set of URLs is used to download the Tor client. We believe the client is decrypted using the configuration serpent key [7]. When the Tor client is retrieved, the bot creates a registry key named “TorClient” in the registry subfolder to store its data. This subfolder is located in HKCU\\Software\AppDataLow\Software\Microsoft\{random guid}. This key contains the path to the client, which is dropped in the %TMP% folder, with a filename using the pattern [A-F0-9]{4}.bin