Trojan.DownLoader11.13042

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutomatosProxyAuth' = '%CommonProgramFiles%\Automatos\proxyauth.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\aloginout] 'DllName' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Automatos Auto Update 0] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\AutomatosDesktopAgent] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'

Creates and executes the following:

'%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe'
'%TEMP%\ADE7EB2\CHECKLOG.EXE' "%TEMP%\ADE7EB2\ada.install.log"
'%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe' -i
'%PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe' -s
'%PROGRAM_FILES%\Automatos\Auto Update\aau.exe'
'%TEMP%\ADE7EB2\ATIVA.EXE'
'%TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE' aau-2.3.8-en.win.exe -s -a -s -waau.telefonica.com.br -DESKTOP -param\"-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui\"
'%TEMP%\ADE7EB2\AAU-2.3.8-EN.WIN.EXE' -s -a -s -waau.telefonica.com.br -DESKTOP -param"-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui"
'%TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE' ada-3.7.7a-en.automatos.exe -s -a -s -f2"%TEMP%\ADE7EB2\ada.install.log" -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
'%TEMP%\ADE7EB2\ADA-3.7.7A-EN.AUTOMATOS.EXE' -s -a -s -f2%TEMP%\ADE7EB2\ada.install.log -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
'%TEMP%\LAU4AA3.EXE'
'%TEMP%\ADE7EB2\CHECKAPP.EXE' {F5B62352-F120-4D57-815C-FB240F6000FC}
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\pft3.tmp\Disk1\Setup.exe' -s -f2%TEMP%\ADE7EB2\ada.install.log -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -plc:\ -scan -perf -noui
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer

Executes the following:

'<SYSTEM32>\netsh.exe' firewall add portopening TCP 8443 Suporte_Telefonica_8443
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 8080 Suporte_Telefonica_8080
'<SYSTEM32>\netsh.exe' firewall set opmode mode = ENABLE exceptions = ENABLE
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 4900 Suporte_Telefonica_4900
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 443 Suporte_Telefonica_443
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 8081 Suporte_Telefonica_8081
'<SYSTEM32>\msiexec.exe' -Embedding C1C4CED05927D957A4CFC020295F81D0
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\aut5.tmp" /qn METADATA_SERVER_URL=aau.telefonica.com.br MACHINE_TYPE="desktop" AGENT_PARAM="-s -a -s -plC: -proxyauth -itelefonica_br@automatos.com -bTI -httphttppdt.telefonica.com.br:8080 -perf -scan -noui"
'%WINDIR%\regedit.exe' /s aau.reg
'%WINDIR%\regedit.exe' /s ada.reg
'<SYSTEM32>\wscript.exe' "%TEMP%\ADE7EB2\SHORTCUT.VBS"

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7dd1.rra
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d63.rra
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu7e5d.rra
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7e2f.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d35.rra
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layo7d15.rra
%PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.ini
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\anti8284.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\aeng8226.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asse82c2.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\asam82a3.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%PROGRAM_FILES%\Automatos\Desktop Agent\adac81c8.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Automatos\Desktop Agent\Control Center.lnk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-03-59_001.cdz
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-03-59_000.cdz
%WINDIR%\Installer\MSI9.tmp
%WINDIR%\Installer\{34D596F3-A716-4A73-98A9-AC65AD2E8DE4}\ProductIcon.exe
%PROGRAM_FILES%\Automatos\Auto Update\msvcp71.dll
%PROGRAM_FILES%\Automatos\Auto Update\aauinstaller.exe
%PROGRAM_FILES%\Automatos\Auto Update\UninstallApp.exe
%PROGRAM_FILES%\Automatos\Auto Update\aaumngr_nt.dll
%WINDIR%\Installer\MSIA.tmp
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\software.data
%ALLUSERSPROFILE%\Desktop\Suporte - Acesso Remoto Telefфnica.lnk
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_2014-03-27_20-04-50_002.cdz
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\softwaremetering.data
%WINDIR%\suporte\automatos\APRCSE_TELEFONICA.EXE
%WINDIR%\aau_service.log
%ALLUSERSPROFILE%\Start Menu\Suporte - Acesso Remoto Telefфnica.lnk
%WINDIR%\suporte\automatos\ICON.BMP
%PROGRAM_FILES%\Automatos\Auto Update\aau.exe
%PROGRAM_FILES%\Automatos\Desktop Agent\phys83ad.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\aeng838e.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtm83fb.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf83cc.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\unin8330.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capa8311.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\mach836e.rra
<SYSTEM32>\alog833f.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\read842a.rra
%WINDIR%\Installer\2c663.msi
%TEMP%\aut5.tmp
C:\Config.Msi\2c666.rbs
%WINDIR%\Installer\MSI6.tmp
%PROGRAM_FILES%\Automatos\Desktop Agent\sntp84e5.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgs8478.rra
%PROGRAM_FILES%\Automatos\Desktop Agent\tmp\aengine_20140327_1203.elog
%CommonProgramFiles%\Automatos\prox8524.rra
%TEMP%\ADE7EB2\UPDATE.BAT
%TEMP%\ADE7EB2\UNINSTALLAPP.EXE
%TEMP%\ADEPLOY.3067.OUT
%TEMP%\ADE6C66.BAT
%TEMP%\ADE7EB2\SHORTCUT.VBS
%TEMP%\ADE7EB2\LAUNCHAPPANDWAIT.EXE
%TEMP%\ADE7EB2\UNINSTALL.EXE
%TEMP%\ADE7EB2\UNINSTALL.BAT
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\Disk1\data1.cab
%TEMP%\pft3.tmp\Disk1\CVS\Root
%TEMP%\pft3.tmp\Disk1\data2.cab
%TEMP%\pft3.tmp\Disk1\data1.hdr
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\pft3.tmp\Disk1\CVS\Repository
%TEMP%\pft3.tmp\Disk1\CVS\Entries
%TEMP%\ADE7EB2\ICON.BMP
%TEMP%\ADE7EB2\AAU.BAT
%TEMP%\ADE7EB2\AAU-2.3.8-EN.WIN.EXE
%TEMP%\ADE7EB2\ADA-3.7.7A-EN.AUTOMATOS.EXE
%TEMP%\ADE7EB2\AAU.REG
%TEMP%\LAU2AB9.EXE
%TEMP%\LAUNCHER.0582.LOG
%TEMP%\ADEPLOY.0588.LOG
%TEMP%\LAU4AA3.EXE
%TEMP%\ADE7EB2\ADA.BAT
%TEMP%\ADE7EB2\CHECKLOG.EXE
%TEMP%\ADE7EB2\CHECKAPP.EXE
%TEMP%\ADE7EB2\ENGINE.INI
%TEMP%\ADE7EB2\CHECKVERSION.EXE
%TEMP%\ADE7EB2\AINSTALL.BAT
%TEMP%\ADE7EB2\ADA.REG
%TEMP%\ADE7EB2\ATIVA.EXE
%TEMP%\ADE7EB2\APRCSE_TELEFONICA.EXE
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdl5559.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsU550b.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\valu55f6.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\lice5579.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libk5440.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whit5421.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view54ec.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu54ae.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt5673.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsR5941.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\defa56e0.rra
C:\adainstall.log
%TEMP%\ADE7EB2\ada.install.log
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\unin53f2.rra
%TEMP%\pft3.tmp\Disk1\setup.inx
%TEMP%\pft3.tmp\Disk1\Setup.ini
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\Disk1\setup.iss
%TEMP%\pft3.tmp\Disk1\layout.bin
%TEMP%\pft3.tmp\Disk1\ikernel.ex_
%TEMP%\pft3.tmp\Disk1\Setup.exe
%TEMP%\pft3.tmp\Disk1\Setup.bmp
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu5317.rra
%CommonProgramFiles%\InstallShield\IScript\iscr4ba5.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\toma53d3.rra
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\info53b4.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor452d.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core44bf.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse483a.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47bd.rra

Deletes the following files:

%TEMP%\pft3.tmp\Disk1\data2.cab
%TEMP%\pft3.tmp\Disk1\data1.hdr
%TEMP%\pft3.tmp\Disk1\ikernel.ex_
%TEMP%\pft3.tmp\Disk1\Setup.bmp
%TEMP%\pft3.tmp\Disk1\layout.bin
%TEMP%\pft3.tmp\Disk1\CVS\Entries.Extra
%TEMP%\pft3.tmp\Disk1\CVS\Entries
%TEMP%\pft3.tmp\Disk1\CVS\Repository
%TEMP%\pft3.tmp\Disk1\data1.cab
%TEMP%\pft3.tmp\Disk1\CVS\Root
%WINDIR%\Installer\MSI9.tmp
C:\Config.Msi\2c666.rbs
%WINDIR%\Installer\MSIA.tmp
%TEMP%\aut5.tmp
%WINDIR%\Installer\2c663.msi
%TEMP%\pft3.tmp\Disk1\Setup.ini
%TEMP%\pft3.tmp\Disk1\Setup.exe
%TEMP%\pft3.tmp\Disk1\setup.inx
%WINDIR%\Installer\MSI6.tmp
%TEMP%\pft3.tmp\Disk1\setup.iss
%TEMP%\plf1.tmp
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\default.pal
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsRes.dll
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt.dll
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\license.txt
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\value.shl
%TEMP%\ext2.tmp
%TEMP%\LAU2AB9.EXE
%TEMP%\pft3.tmp\pftw1.pkg
%ALLUSERSPROFILE%\Start Menu\Programs\Automatos\Desktop Agent\Control Center.lnk
%TEMP%\IEC4.tmp
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\uninstall.iss
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whitesquare.bmp
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\tomato.bmp
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\infolist.txt
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsUser.dll
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdline.txt
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view.bmp
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libkey.dll
%TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setuputl.dll

Moves the following files:

from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\anti8284.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\antivirus.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\aeng8226.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\aengine.exe
from %PROGRAM_FILES%\Automatos\Desktop Agent\asam82a3.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\asamngr.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capa8311.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\capacity.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asse82c2.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\asset.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\adac81c8.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\adacontrol.exe
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d63.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data1.cab
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data7d35.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\data1.hdr
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7dd1.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.exe
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu7e5d.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setu7e2f.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\Setup.ini
from %PROGRAM_FILES%\Automatos\Desktop Agent\read842a.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\readme.txt
from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtm83fb.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\prtmon.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgs8478.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\plgsoftwaremetering.dll
from %CommonProgramFiles%\Automatos\prox8524.rra to %CommonProgramFiles%\Automatos\proxyauth.exe
from %PROGRAM_FILES%\Automatos\Desktop Agent\sntp84e5.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\sntpservice.exe
from %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf83cc.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\plugins\perf.dll
from <SYSTEM32>\alog833f.rra to <SYSTEM32>\aloginout.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\unin8330.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\uninstall.iss
from %PROGRAM_FILES%\Automatos\Desktop Agent\mach836e.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\machineid.dll
from %PROGRAM_FILES%\Automatos\Desktop Agent\phys83ad.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\physaddr.sys
from %PROGRAM_FILES%\Automatos\Desktop Agent\aeng838e.rra to %PROGRAM_FILES%\Automatos\Desktop Agent\aengmsg.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\info53b4.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\infolist.txt
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu5317.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setup.inx
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\toma53d3.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\tomato.bmp
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whit5421.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\whitesquare.bmp
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\unin53f2.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\uninstall.iss
from %CommonProgramFiles%\InstallShield\IScript\iscr4ba5.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core44bf.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor452d.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse483a.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47bd.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt5673.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\isrt.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\valu55f6.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\value.shl
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\defa56e0.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\default.pal
from %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layo7d15.rra to %PROGRAM_FILES%\InstallShield Installation Information\{F5B62352-F120-4D57-815C-FB240F6000FC}\layout.bin
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsR5941.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsRes.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\lice5579.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\license.txt
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setu54ae.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\setuputl.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libk5440.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\libkey.dll
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view54ec.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\view.bmp
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdl5559.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\cmdline.txt
from %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsU550b.rra to %TEMP%\{F5B62352-F120-4D57-815C-FB240F6000FC}\_IsUser.dll

Network activity:

Connects to:

'ht#####.telefonica.com.br':8080

UDP:

DNS ASK ht#####.telefonica.com.br

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial