Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{35b83883-40fa-423c-ae73-2aff7e1ea820}' = '"%PROGRAMDATA%\Package Cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x...
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\agent.exe
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ao9s2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-0hma6.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-s1gc8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9kjit.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-m598m.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-b5mjm.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-mmpfi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-l46ii.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vicl7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r5n6q.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ma12n.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t78uc.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-0jr9t.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-venuo.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ajgav.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-nhkp8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-p5div.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-cefao.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-k4vbi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-iujep.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-25f0l.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-7f4e3.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ce6au.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-1b867.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\advanced monitoring agent.lnk
- %ProgramFiles(x86)%\advanced monitoring agent\unins000.dat
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cab54a5cabbe7274d8a22eb58060aab7623
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeadditional_x86
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\state.rsm
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.be\vcredist_x86.exe
- %TEMP%\dd_vcredist_x86_20200401204553.log
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\license.rtf
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\logo.png
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.wxl
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\wixstdba.dll
- %ProgramFiles(x86)%\advanced monitoring agent\settings.ini
- %ProgramFiles(x86)%\advanced monitoring agent\images\tagline.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\splash.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\about.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-83lqe.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jqdgo.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-i8900.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-vjduk.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-kgp8u.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-d2bur.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-vop23.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-24ba6.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-uft9e.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-j0t15.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-jigbu.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-banpi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-vslqn.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-tgnrc.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-qb2gd.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ks5c0.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-4bo30.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-c35ds.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-5cju3.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ouekp.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-211ci.tmp
- %TEMP%\is-2agep.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2agep.tmp\_isetup\_setup64.tmp
- %TEMP%\is-797vv.tmp\agent.tmp
- %TEMP%\7zipsfx.000\package.zip
- %ProgramFiles(x86)%\advanced monitoring agent\is-ugvl6.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-abts8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ooamu.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-gasbl.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ccllq.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ih1oe.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-toov0.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t4jbo.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hpkvv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-63cj2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-v7a44.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ecogj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o9fv4.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-32i1s.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6fvms.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-l761o.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-8pqti.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o87q6.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-pf2ri.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6ss6f.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-h1k9g.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-brv55.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-22rqb.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-cj7q1.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-lsml7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-3lf03.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-95jvh.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-19078.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Deletes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cab54a5cabbe7274d8a22eb58060aab7623
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeadditional_x86
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\state.rsm
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\license.rtf
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\logo.png
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.wxl
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\wixstdba.dll
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.be\vcredist_x86.exe
Moves the following files
- from %ProgramFiles(x86)%\advanced monitoring agent\is-211ci.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unins000.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-k4vbi.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_hacker.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-iujep.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_file_size.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-25f0l.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_exchange.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-7f4e3.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_event_log.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-83lqe.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space_change.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jqdgo.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-cefao.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_legacy.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-19078.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_critical_events.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ccllq.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_backup.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ih1oe.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_automated_task.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-toov0.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_antivirus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t4jbo.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\checkutils.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hpkvv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\agent_uptime.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-v7a44.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\ssleay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-i8900.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-p5div.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-nhkp8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_memory.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ajgav.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_network.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ma12n.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\results.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ao9s2.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\errors.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-0hma6.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\cimdate.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-s1gc8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_wsus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9kjit.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_protection_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-m598m.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_page.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-b5mjm.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_tcp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-mmpfi.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_snmp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-l46ii.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_service.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vicl7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_script.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r5n6q.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_ping.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t78uc.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk_smart.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ce6au.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-0jr9t.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_utilisation.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-venuo.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_queue.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ecogj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\scriptlauncher.js
- from %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-1b867.tmp to %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\scriptrunnerinstaller.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o9fv4.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5qml.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6fvms.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5core.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-vop23.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-24ba6.tmp to %ProgramFiles(x86)%\advanced monitoring agent\winagent.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-uft9e.tmp to %ProgramFiles(x86)%\advanced monitoring agent\_avg7api.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-j0t15.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavcomm.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-jigbu.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-banpi.tmp to %ProgramFiles(x86)%\advanced monitoring agent\assetscan.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-d2bur.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus2.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-vslqn.tmp to %ProgramFiles(x86)%\advanced monitoring agent\services.ini
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ugvl6.tmp to %ProgramFiles(x86)%\advanced monitoring agent\6.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ks5c0.tmp to %ProgramFiles(x86)%\advanced monitoring agent\5.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-4bo30.tmp to %ProgramFiles(x86)%\advanced monitoring agent\4.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-c35ds.tmp to %ProgramFiles(x86)%\advanced monitoring agent\3.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-5cju3.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ouekp.tmp to %ProgramFiles(x86)%\advanced monitoring agent\1.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-qb2gd.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2000.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-kgp8u.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus3.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-vjduk.tmp to %ProgramFiles(x86)%\advanced monitoring agent\iscanruntime.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-tgnrc.tmp to %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-l761o.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\performance.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-8pqti.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\network.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o87q6.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\logger.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-pf2ri.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libssl32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6ss6f.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libeay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-h1k9g.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\legacy.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-brv55.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugincore.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-22rqb.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugin.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-cj7q1.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\externalapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-lsml7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checkapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-3lf03.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\backup.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-95jvh.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\av.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-gasbl.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ooamu.tmp to %ProgramFiles(x86)%\advanced monitoring agent\task_start.js
- from %ProgramFiles(x86)%\advanced monitoring agent\is-abts8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unzip.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-32i1s.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5network.dll
- from %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Substitutes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\agent.exe' /VERYSILENT /norestart
- '%TEMP%\is-797vv.tmp\agent.tmp' /SL5="$9021C,17572046,56832,%TEMP%\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe'
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart -burn.unelevated BurnPipe.{8B2F5F4D-E794-433E-9EAB-E16FB956DEC8} {ABE76683-EBF2-419E-9DF8-C608BB808B4D} 2068
- '%ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\scriptrunnerinstaller.exe' /silent /install /norestart InstallPath="%ProgramFiles(x86)%\Advanced Monitoring Agent\ScriptRunner"
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart' (with hidden window)
- '%TEMP%\{e71fdf69-c4da-42af-9024-a02c9b5041db}\.be\scriptrunner.installer.exe' -q -burn.elevated BurnPipe.{5E96A6B2-5F2E-4ABA-A4C5-B465FAD87BD3} {299C315F-1C55-4567-A809-96A4D96295A9} 2116' (with hidden window)
