Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'Logon' = 'WLEventLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'Startup' = 'WLEventStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutomatosProxyAuth' = '%CommonProgramFiles%\Automatos\proxyauth.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'DllName' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Automatos Auto Update 0] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AutomatosDesktopAgent] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe'
- '%TEMP%\ADE7EB2\CHECKLOG.EXE' "%TEMP%\ADE7EB2\ada.install.log"
- '%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe' -i
- '%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe' -s
- '%PROGRAM_FILES%\Automatos\Auto Update\aau.exe'
- '%TEMP%\ADE7EB2\ATIVA.EXE'
- '%TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE' aau-2.3.8-en.win.exe -s -a -s -waau.telefonica.com.br -DESKTOP -param\"-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui\"
- '%TEMP%\ADE7EB2\AAU-2.3.8-EN.WIN.EXE' -s -a -s -waau.telefonica.com.br -DESKTOP -param"-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui"
- '%TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE' ada-3.7.7a-en.automatos.exe -s -a -s -f2"%TEMP%\ADE7EB2\ada.install.log" -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
- '%TEMP%\ADE7EB2\ADA-3.7.7A-EN.AUTOMATOS.EXE' -s -a -s -f2%TEMP%\ADE7EB2\ada.install.log -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
- '%TEMP%\LAU4AA3.EXE'
- '%TEMP%\ADE7EB2\CHECKAPP.EXE' {F5B62352-F120-4D57-815C-FB240F6000FC}
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3.tmp\Disk1\Setup.exe' -s -f2%TEMP%\ADE7EB2\ada.install.log -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 8443 Suporte_Telefonica_8443
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 8080 Suporte_Telefonica_8080
- '<SYSTEM32>\netsh.exe' firewall set opmode mode = ENABLE exceptions = ENABLE
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 4900 Suporte_Telefonica_4900
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 443 Suporte_Telefonica_443
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 8081 Suporte_Telefonica_8081
- '<SYSTEM32>\msiexec.exe' -Embedding C1C4CED05927D957A4CFC020295F81D0
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\aut5.tmp" /qn METADATA_SERVER_URL=aau.telefonica.com.br MACHINE_TYPE="desktop" AGENT_PARAM="-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui"
- '%WINDIR%\regedit.exe' /s aau.reg
- '%WINDIR%\regedit.exe' /s ada.reg
- '<SYSTEM32>\wscript.exe' "%TEMP%\ADE7EB2\SHORTCUT.VBS"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7dd1.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d63.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu7e5d.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7e2f.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d35.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layo7d15.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.ini
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\anti8284.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\aeng8226.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asse82c2.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\asam82a3.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %PROGRAM_FILES%\Automatos\Desktop Agent\adac81c8.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\Automatos\Desktop Agent\Control Center.lnk
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-03-59_001.cdz
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-03-59_000.cdz
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\{34D596F3-A716-4A73-98A9-AC65AD2E8DE4}\ProductIcon.exe
- %PROGRAM_FILES%\Automatos\Auto Update\msvcp71.dll
- %PROGRAM_FILES%\Automatos\Auto Update\aauinstaller.exe
- %PROGRAM_FILES%\Automatos\Auto Update\UninstallApp.exe
- %PROGRAM_FILES%\Automatos\Auto Update\aaumngr_nt.dll
- %WINDIR%\Installer\MSIA.tmp
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\software.data
- %ALLUSERSPROFILE%\Desktop\Suporte - Acesso Remoto Telefфnica.lnk
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-04-50_002.cdz
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\softwaremetering.data
- %WINDIR%\suporte\automatos\APRCSE_TELEFONICA.EXE
- %WINDIR%\aau_service.log
- %ALLUSERSPROFILE%\Start Menu\Suporte - Acesso Remoto Telefфnica.lnk
- %WINDIR%\suporte\automatos\ICON.BMP
- %PROGRAM_FILES%\Automatos\Auto Update\aau.exe
- %PROGRAM_FILES%\Automatos\Desktop Agent\phys83ad.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\aeng838e.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtm83fb.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf83cc.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\unin8330.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capa8311.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\mach836e.rra
- <SYSTEM32>\alog833f.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\read842a.rra
- %WINDIR%\Installer\2c663.msi
- %TEMP%\aut5.tmp
- C:\Config.Msi\2c666.rbs
- %WINDIR%\Installer\MSI6.tmp
- %PROGRAM_FILES%\Automatos\Desktop Agent\sntp84e5.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgs8478.rra
- %PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_20140327_1203.elog
- %CommonProgramFiles%\Automatos\prox8524.rra
- %TEMP%\ADE7EB2\UPDATE.BAT
- %TEMP%\ADE7EB2\UNINSTALLAPP.EXE
- %TEMP%\ADEPLOY.3067.OUT
- %TEMP%\ADE6C66.BAT
- %TEMP%\ADE7EB2\SHORTCUT.VBS
- %TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE
- %TEMP%\ADE7EB2\UNINSTALL.EXE
- %TEMP%\ADE7EB2\UNINSTALL.BAT
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\Disk1\CVS\Root
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\Disk1\CVS\Repository
- %TEMP%\pft3.tmp\Disk1\CVS\Entries
- %TEMP%\ADE7EB2\ICON.BMP
- %TEMP%\ADE7EB2\AAU.BAT
- %TEMP%\ADE7EB2\AAU-2.3.8-EN.WIN.EXE
- %TEMP%\ADE7EB2\ADA-3.7.7A-EN.AUTOMATOS.EXE
- %TEMP%\ADE7EB2\AAU.REG
- %TEMP%\LAU2AB9.EXE
- %TEMP%\LAUNCHER.0582.LOG
- %TEMP%\ADEPLOY.0588.LOG
- %TEMP%\LAU4AA3.EXE
- %TEMP%\ADE7EB2\ADA.BAT
- %TEMP%\ADE7EB2\CHECKLOG.EXE
- %TEMP%\ADE7EB2\CHECKAPP.EXE
- %TEMP%\ADE7EB2\ENGINE.INI
- %TEMP%\ADE7EB2\CHECKVERSION.EXE
- %TEMP%\ADE7EB2\AINSTALL.BAT
- %TEMP%\ADE7EB2\ADA.REG
- %TEMP%\ADE7EB2\ATIVA.EXE
- %TEMP%\ADE7EB2\APRCSE_TELEFONICA.EXE
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdl5559.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsU550b.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\valu55f6.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\lice5579.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libk5440.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whit5421.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view54ec.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu54ae.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt5673.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsR5941.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\defa56e0.rra
- C:\adainstall.log
- %TEMP%\ADE7EB2\ada.install.log
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\unin53f2.rra
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\IEC4.tmp
- %TEMP%\pft3.tmp\Disk1\setup.iss
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- %TEMP%\pft3.tmp\Disk1\Setup.bmp
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu5317.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr4ba5.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\toma53d3.rra
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\info53b4.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor452d.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core44bf.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse483a.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47bd.rra
Удаляет следующие файлы:
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- %TEMP%\pft3.tmp\Disk1\Setup.bmp
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\CVS\Entries.Extra
- %TEMP%\pft3.tmp\Disk1\CVS\Entries
- %TEMP%\pft3.tmp\Disk1\CVS\Repository
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\Disk1\CVS\Root
- %WINDIR%\Installer\MSI9.tmp
- C:\Config.Msi\2c666.rbs
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\aut5.tmp
- %WINDIR%\Installer\2c663.msi
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %WINDIR%\Installer\MSI6.tmp
- %TEMP%\pft3.tmp\Disk1\setup.iss
- %TEMP%\plf1.tmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\default.pal
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsRes.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\license.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\value.shl
- %TEMP%\ext2.tmp
- %TEMP%\LAU2AB9.EXE
- %TEMP%\pft3.tmp\pftw1.pkg
- %ALLUSERSPROFILE%\Start Menu\Programs\Automatos\Desktop Agent\Control Center.lnk
- %TEMP%\IEC4.tmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\uninstall.iss
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whitesquare.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\tomato.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\infolist.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsUser.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdline.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libkey.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setuputl.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\anti8284.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\antivirus.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\aeng8226.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe
- %PROGRAM_FILES%\Automatos\Desktop Agent\asam82a3.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\asamngr.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capa8311.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capacity.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asse82c2.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asset.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\adac81c8.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\adacontrol.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d63.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d35.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7dd1.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu7e5d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7e2f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.ini
- %PROGRAM_FILES%\Automatos\Desktop Agent\read842a.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\readme.txt
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtm83fb.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtmon.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgs8478.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgsoftwaremetering.dll
- %CommonProgramFiles%\Automatos\prox8524.rra в %CommonProgramFiles%\Automatos\proxyauth.exe
- %PROGRAM_FILES%\Automatos\Desktop Agent\sntp84e5.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\sntpservice.exe
- %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf83cc.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf.dll
- <SYSTEM32>\alog833f.rra в <SYSTEM32>\aloginout.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\unin8330.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\uninstall.iss
- %PROGRAM_FILES%\Automatos\Desktop Agent\mach836e.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\machineid.dll
- %PROGRAM_FILES%\Automatos\Desktop Agent\phys83ad.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\physaddr.sys
- %PROGRAM_FILES%\Automatos\Desktop Agent\aeng838e.rra в %PROGRAM_FILES%\Automatos\Desktop Agent\aengmsg.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\info53b4.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\infolist.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu5317.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\toma53d3.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\tomato.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whit5421.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whitesquare.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\unin53f2.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\uninstall.iss
- %CommonProgramFiles%\InstallShield\IScript\iscr4ba5.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core44bf.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor452d.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse483a.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47bd.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt5673.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\valu55f6.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\value.shl
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\defa56e0.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\default.pal
- %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layo7d15.rra в %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layout.bin
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsR5941.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsRes.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\lice5579.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\license.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu54ae.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setuputl.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libk5440.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libkey.dll
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view54ec.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view.bmp
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdl5559.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdline.txt
- %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsU550b.rra в %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsUser.dll
Сетевая активность:
Подключается к:
- 'ht#####.telefonica.com.br':8080
UDP:
- DNS ASK ht#####.telefonica.com.br
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
