Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{35b83883-40fa-423c-ae73-2aff7e1ea820}' = '"%PROGRAMDATA%\Package Cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x...
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\agent.exe
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5nq7k.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-aoi06.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-3o33u.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r6mou.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u6ae0.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-96sms.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-sopum.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-8hqbm.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hgrj5.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qihgg.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-070g1.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u26mq.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t51ta.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qscea.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ocdci.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9dlvm.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-dr9mo.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r9r5k.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-6sf48.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5lbrd.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hh9dm.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ta6vj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-pqo7h.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-qspab.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\advanced monitoring agent.lnk
- %ProgramFiles(x86)%\advanced monitoring agent\unins000.dat
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cab54a5cabbe7274d8a22eb58060aab7623
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeadditional_x86
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\state.rsm
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.be\vcredist_x86.exe
- %TEMP%\dd_vcredist_x86_20200405202722.log
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\license.rtf
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\logo.png
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.wxl
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\wixstdba.dll
- %ProgramFiles(x86)%\advanced monitoring agent\settings.ini
- %ProgramFiles(x86)%\advanced monitoring agent\images\tagline.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\splash.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\about.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-k5c61.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ckulv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-oouph.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ub3eq.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ckq7f.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-tq4e8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-1d4nl.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-hhr5d.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-uj6bp.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-h3vch.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-j5vlh.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-62k75.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-8lo8o.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-m071q.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-6om64.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-4drpc.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-2daij.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-jlci9.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-hamm9.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-13ila.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-d3f1i.tmp
- %TEMP%\is-3bas9.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3bas9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3t5c9.tmp\agent.tmp
- %TEMP%\7zipsfx.000\package.zip
- %ProgramFiles(x86)%\advanced monitoring agent\is-sa1lk.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-fsc82.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-hlebi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-cs9i7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r25u7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-76puj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-kk914.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vd14m.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jp0t2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-pg9oi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-4kae4.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o5669.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-5n6mp.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-7qkr4.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-imapk.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-l19nj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-um83k.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-m0mhg.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-0415t.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-dol5r.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-npuvs.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-g1oqu.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-h0qp6.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ht9ia.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ongbp.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-i9ean.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-abcto.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vljkd.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Deletes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Moves the following files
- from %ProgramFiles(x86)%\advanced monitoring agent\is-d3f1i.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unins000.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-6sf48.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_hacker.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5lbrd.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_file_size.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hh9dm.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_exchange.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ta6vj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_event_log.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-k5c61.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space_change.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ckulv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r9r5k.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_legacy.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vljkd.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_critical_events.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r25u7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_backup.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-76puj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_automated_task.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-kk914.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_antivirus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vd14m.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\checkutils.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jp0t2.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\agent_uptime.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-4kae4.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\ssleay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-oouph.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-dr9mo.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9dlvm.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_memory.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ocdci.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_network.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-070g1.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\results.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5nq7k.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\errors.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-aoi06.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\cimdate.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-3o33u.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_wsus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-r6mou.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_protection_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u6ae0.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_page.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-96sms.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_tcp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-sopum.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_snmp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-8hqbm.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_service.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-hgrj5.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_script.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qihgg.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_ping.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u26mq.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk_smart.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-pqo7h.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t51ta.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_utilisation.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qscea.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_queue.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-o5669.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\scriptlauncher.js
- from %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-qspab.tmp to %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\scriptrunnerinstaller.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-5n6mp.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5qml.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-imapk.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5core.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-1d4nl.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-hhr5d.tmp to %ProgramFiles(x86)%\advanced monitoring agent\winagent.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-uj6bp.tmp to %ProgramFiles(x86)%\advanced monitoring agent\_avg7api.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-h3vch.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavcomm.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-j5vlh.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-62k75.tmp to %ProgramFiles(x86)%\advanced monitoring agent\assetscan.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-tq4e8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus2.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-8lo8o.tmp to %ProgramFiles(x86)%\advanced monitoring agent\services.ini
- from %ProgramFiles(x86)%\advanced monitoring agent\is-sa1lk.tmp to %ProgramFiles(x86)%\advanced monitoring agent\6.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-4drpc.tmp to %ProgramFiles(x86)%\advanced monitoring agent\5.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-2daij.tmp to %ProgramFiles(x86)%\advanced monitoring agent\4.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-jlci9.tmp to %ProgramFiles(x86)%\advanced monitoring agent\3.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-hamm9.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-13ila.tmp to %ProgramFiles(x86)%\advanced monitoring agent\1.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-6om64.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2000.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ckq7f.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus3.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ub3eq.tmp to %ProgramFiles(x86)%\advanced monitoring agent\iscanruntime.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-m071q.tmp to %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-l19nj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\performance.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-um83k.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\network.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-m0mhg.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\logger.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-0415t.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libssl32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-dol5r.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libeay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-npuvs.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\legacy.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-g1oqu.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugincore.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-h0qp6.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugin.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ht9ia.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\externalapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ongbp.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checkapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-i9ean.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\backup.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-abcto.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\av.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-cs9i7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-hlebi.tmp to %ProgramFiles(x86)%\advanced monitoring agent\task_start.js
- from %ProgramFiles(x86)%\advanced monitoring agent\is-fsc82.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unzip.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-7qkr4.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5network.dll
- from %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Substitutes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\agent.exe' /VERYSILENT /norestart
- '%TEMP%\is-3t5c9.tmp\agent.tmp' /SL5="$A0226,18244584,56832,%TEMP%\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe'
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart -burn.unelevated BurnPipe.{3F20C6F4-D667-4B5E-A980-3B85FE1598BF} {B4547533-D383-4BF9-BABD-C76BCD899A90} 2836
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart' (with hidden window)
