Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{35b83883-40fa-423c-ae73-2aff7e1ea820}' = '"%PROGRAMDATA%\Package Cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x...
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\agent.exe
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ninat.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-kjcd5.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-fqncr.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-mpgck.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-7s011.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-btui5.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u3dll.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-3rfjp.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-msff2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-014op.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-07vcu.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-1hr1v.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-toot8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jmqs7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t5t42.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t5fhf.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vj0nq.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-37jbn.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5efi5.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-nabmg.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-f5uf0.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-6mhai.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-4l5bl.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-v26pa.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\advanced monitoring agent.lnk
- %ProgramFiles(x86)%\advanced monitoring agent\unins000.dat
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cab54a5cabbe7274d8a22eb58060aab7623
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeadditional_x86
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\state.rsm
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.be\vcredist_x86.exe
- %TEMP%\dd_vcredist_x86_20200507125027.log
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\license.rtf
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\logo.png
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.wxl
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\wixstdba.dll
- %ProgramFiles(x86)%\advanced monitoring agent\settings.ini
- %ProgramFiles(x86)%\advanced monitoring agent\images\tagline.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\splash.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\dsc.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\about.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247_header.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\images\247.bmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9uu6h.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-m50vv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-4i2fv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-5uon3.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-pae11.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-rq8a2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-i2itu.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-8qgm5.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-f90v1.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-22cbs.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-hlu19.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-1jnh1.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-obl5q.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-80sln.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-vlqik.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-32r6v.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-fkbrj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-ecnvj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-7ilee.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-veib8.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-0qeal.tmp
- %TEMP%\is-dcb80.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-dcb80.tmp\_isetup\_setup64.tmp
- %TEMP%\is-li29v.tmp\agent.tmp
- %TEMP%\7zipsfx.000\package.zip
- %ProgramFiles(x86)%\advanced monitoring agent\is-5sbs1.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-3i0vv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\is-p1h9h.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-keg8k.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-f5mvd.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vba75.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-at58b.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qpp77.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-cjrv2.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-5lvp9.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-m3euv.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-d96fi.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-c5lbn.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6s1nj.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-qrjr7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-fnjs7.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-es3fl.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-nb1nd.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-nc91d.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-9stke.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-3ngp3.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ucd1s.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6k2pm.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-sbcjg.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-533qa.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-d7mka.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-u3mgc.tmp
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5oun3.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Deletes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cab54a5cabbe7274d8a22eb58060aab7623
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeadditional_x86
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\state.rsm
- %PROGRAMDATA%\package cache\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\license.rtf
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\logo.png
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.wxl
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\thm.xml
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.ba1\wixstdba.dll
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\.be\vcredist_x86.exe
Moves the following files
- from %ProgramFiles(x86)%\advanced monitoring agent\is-0qeal.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unins000.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5efi5.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_hacker.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-nabmg.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_file_size.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-f5uf0.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_exchange.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-6mhai.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_event_log.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-9uu6h.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space_change.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-m50vv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_disk_space.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-37jbn.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_legacy.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-5oun3.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_critical_events.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-f5mvd.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_backup.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vba75.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_automated_task.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-at58b.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_antivirus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-qpp77.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\checkutils.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-cjrv2.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\agent_uptime.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-m3euv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\ssleay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-4i2fv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-vj0nq.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t5fhf.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_memory.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-t5t42.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_network.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-07vcu.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\results.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-ninat.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\errors.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-kjcd5.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\cimdate.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-fqncr.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_wsus.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-mpgck.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_protection_bandwidth.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-7s011.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_web_page.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-btui5.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_tcp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-u3dll.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_snmp.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-3rfjp.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_service.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-msff2.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_script.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-014op.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_ping.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-1hr1v.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk_smart.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-4l5bl.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_physical_disk.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-toot8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_utilisation.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\is-jmqs7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checks\check_performance_processor_queue.js
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-d96fi.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\scriptlauncher.js
- from %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\is-v26pa.tmp to %ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\scriptrunnerinstaller.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-c5lbn.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5qml.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-qrjr7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5core.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-i2itu.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-8qgm5.tmp to %ProgramFiles(x86)%\advanced monitoring agent\winagent.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-f90v1.tmp to %ProgramFiles(x86)%\advanced monitoring agent\_avg7api.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-22cbs.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavcomm.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-hlu19.tmp to %ProgramFiles(x86)%\advanced monitoring agent\pavapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\is-1jnh1.tmp to %ProgramFiles(x86)%\advanced monitoring agent\assetscan.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-rq8a2.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus2.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-obl5q.tmp to %ProgramFiles(x86)%\advanced monitoring agent\services.ini
- from %ProgramFiles(x86)%\advanced monitoring agent\is-5sbs1.tmp to %ProgramFiles(x86)%\advanced monitoring agent\6.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-32r6v.tmp to %ProgramFiles(x86)%\advanced monitoring agent\5.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-fkbrj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\4.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-ecnvj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\3.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-7ilee.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-veib8.tmp to %ProgramFiles(x86)%\advanced monitoring agent\1.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-vlqik.tmp to %ProgramFiles(x86)%\advanced monitoring agent\2000.lng
- from %ProgramFiles(x86)%\advanced monitoring agent\is-pae11.tmp to %ProgramFiles(x86)%\advanced monitoring agent\wsus3.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-5uon3.tmp to %ProgramFiles(x86)%\advanced monitoring agent\iscanruntime.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-80sln.tmp to %ProgramFiles(x86)%\advanced monitoring agent\package.zip
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-fnjs7.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\performance.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-es3fl.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\network.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-nb1nd.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\logger.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-nc91d.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libssl32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-9stke.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\libeay32.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-3ngp3.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\legacy.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-ucd1s.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugincore.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6k2pm.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\fmplugin.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-sbcjg.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\externalapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-533qa.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\checkapi.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-d7mka.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\backup.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-u3mgc.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\av.dll
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-keg8k.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\is-p1h9h.tmp to %ProgramFiles(x86)%\advanced monitoring agent\task_start.js
- from %ProgramFiles(x86)%\advanced monitoring agent\is-3i0vv.tmp to %ProgramFiles(x86)%\advanced monitoring agent\unzip.exe
- from %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\is-6s1nj.tmp to %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\qt5network.dll
- from %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Substitutes the following files
- %ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe
- %TEMP%\{35b83883-40fa-423c-ae73-2aff7e1ea820}\vcruntimeminimum_x86
- %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\agent.exe' /VERYSILENT /norestart
- '%TEMP%\is-li29v.tmp\agent.tmp' /SL5="$5023E,18244584,56832,%TEMP%\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe'
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart -burn.unelevated BurnPipe.{84F078FF-77B4-4EDD-AA8A-DF3182C70420} {E0B9D357-50B4-4AC6-9A4B-FBDECD2BD823} 1184
- '%ProgramFiles(x86)%\advanced monitoring agent\scriptrunner\scriptrunnerinstaller.exe' /silent /install /norestart InstallPath="%ProgramFiles(x86)%\Advanced Monitoring Agent\ScriptRunner"
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' package.zip' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\unzip.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\advanced monitoring agent\fmplugin\vcredist_x86.exe' /install /quiet /norestart' (with hidden window)
- '%TEMP%\{1d72ddac-4801-4859-beee-1683266b3827}\.be\scriptrunner.installer.exe' -q -burn.elevated BurnPipe.{29965001-F154-4F0F-BFCE-FBD10DF89836} {BF21948C-693C-4515-8EE5-D1E39C00828E} 904' (with hidden window)
