The  loader implements itself with the name Security Support Provider, a legitimate Windows function. Various  .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.  also disguised malicious modules using similar filenames as custom network encryption software on victims.