Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{E049B731-B548-4965-8498-445D9ABA71A7}' = 'Prg Mon Interceptor'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\ProVision\Agent\Agent.exe' = '%ProgramFiles%\ProVision\...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\ProVision\Agent\SvcRHost.exe' = '%ProgramFiles%\ProVisi...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\ProVision\Agent\ActSync.exe' = '%ProgramFiles%\ProVisio...
Executes the following:
- '<SYSTEM32>\net.exe' stop "ProVision Agent Service"
- '<SYSTEM32>\net.exe' stop "ProVision-RHost"
Modifies file system:
Creates the following files:
- %TEMP%\ext2.tmp
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Driv1704.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Defr16e4.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\IS_C1677.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Rela1648.rra
- %ProgramFiles%\ProVision\Agent\Prov1638.rra
- %ProgramFiles%\ProVision\Agent\NetC15bb.rra
- %ProgramFiles%\ProVision\Agent\Agen1510.rra
- %ProgramFiles%\ProVision\Agent\prov1500.rra
- %ProgramFiles%\ProVision\Agent\Cafe14b2.rra
- %ProgramFiles%\ProVision\Agent\Agen13b8.rra
- %ProgramFiles%\ProVision\Agent\TBTo12fc.rra
- %ProgramFiles%\ProVision\Agent\proh12ed.rra
- %ProgramFiles%\ProVision\Agent\Cafe1202.rra
- %ProgramFiles%\ProVision\Agent\acts11c4.rra
- %ProgramFiles%\ProVision\Agent\SvcA11b4.rra
- %ProgramFiles%\ProVision\Agent\Powe11a5.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\ProVision\Agent\Agen106c.rra
- %ProgramFiles%\ProVision\Agent\Upgr105c.rra
- <SYSTEM32>\ActI100e.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Driv1752.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Xcov1781.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\Xcov186b.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\lua51a11.rra
- <SYSTEM32>\RCHo1d6c.rra
- <SYSTEM32>\RCHo1d4d.rra
- <SYSTEM32>\Moni1d3d.rra
- %ProgramFiles%\ProVision\Agent\SvcR1d1e.rra
- <SYSTEM32>\pro_1cef.rra
- <SYSTEM32>\pro_1cc0.rra
- <SYSTEM32>\pro_1ca1.rra
- <SYSTEM32>\ps1c72.rra
- <SYSTEM32>\ps1c1c43.rra
- <SYSTEM32>\pro_1c24.rra
- <SYSTEM32>\pro_1bf5.rra
- <SYSTEM32>\ActL1b97.rra
- <SYSTEM32>\ASL1ba7.rra
- <SYSTEM32>\UnAg1b78.rra
- <SYSTEM32>\SWIn1b69.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\zenw1b2a.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\wgx1b0b.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udef1afb.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udef1adc.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\lua51aad.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\zenw1a6f.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\wgx1a5f.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udef1a4f.rra
- %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udef1a30.rra
- <SYSTEM32>\PrgM1d9b.rra
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setufb1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setufa1.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssvc867.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\licec818.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setuc70f.rra
- %CommonProgramFiles%\InstallShield\IScript\iscrb730.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuseb348.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objeb29c.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctoraf9f.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coreaef3.rra
- %TEMP%\a51f.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC4.tmp
- %TEMP%\pft3.tmp\Disk1\vssver.scc
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- %TEMP%\pft3.tmp\Disk1\setup.bmp
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\licec8c4.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssvc912.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\valuca1c.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssvca5b.rra
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setuf82.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\dataf62.rra
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\dataf43.rra
- %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\layof34.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\_IsRcd1a.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\defacc2f.rra
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\isrtcb45.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\RenoSoft\XCovery\Auto1dba.rra
Deletes the following files:
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\IEC4.tmp
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\license.txt
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssver.scc
Moves the following files:
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Defr16e4.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\DefragRun.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Driv1704.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\DriverInstallJp.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Driv1752.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\DriverUnInstall.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Xcov1781.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\XcoveryTBQ.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Xcov186b.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\XcoveryTB.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\lua51a11.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\lua5.1a.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udef1a30.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udefrag.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udef1a4f.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\udefrag.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\wgx1a5f.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\wgx.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\zenw1a6f.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag32\zenwinx.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\lua51aad.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\lua5.1a.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udef1adc.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udefrag.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udef1afb.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\udefrag.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\wgx1b0b.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\wgx.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\zenw1b2a.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\defrag64\zenwinx.dll
- from <SYSTEM32>\SWIn1b69.rra to <SYSTEM32>\SWInfoDll.dll
- from <SYSTEM32>\UnAg1b78.rra to <SYSTEM32>\UnAgent.exe
- from <SYSTEM32>\RCHo1d6c.rra to <SYSTEM32>\RCHost.dll
- from <SYSTEM32>\RCHo1d4d.rra to <SYSTEM32>\RCHook.dll
- from <SYSTEM32>\Moni1d3d.rra to <SYSTEM32>\Monitor.dll
- from %ProgramFiles%\ProVision\Agent\SvcR1d1e.rra to %ProgramFiles%\ProVision\Agent\SvcRHost.exe
- from <SYSTEM32>\pro_1cef.rra to <SYSTEM32>\pro_defrag.bmp
- from <SYSTEM32>\pro_1cc0.rra to <SYSTEM32>\pro_open.bmp
- from <SYSTEM32>\ps1c43.rra to <SYSTEM32>\ps.dl_
- from <SYSTEM32>\pro_1ca1.rra to <SYSTEM32>\pro_recovery.bmp
- from <SYSTEM32>\ps1c72.rra to <SYSTEM32>\ps.dll
- from <SYSTEM32>\ps1c1c43.rra to <SYSTEM32>\ps1c43.rra
- from <SYSTEM32>\pro_1c24.rra to <SYSTEM32>\pro_remote.bmp
- from <SYSTEM32>\pro_1bf5.rra to <SYSTEM32>\pro_lock.bmp
- from <SYSTEM32>\ASL1ba7.rra to <SYSTEM32>\ASL.bin
- from <SYSTEM32>\ActL1b97.rra to <SYSTEM32>\ActLock.dll
- from <SYSTEM32>\PrgM1d9b.rra to <SYSTEM32>\PrgMon.dll
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\IS_C1677.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\IS_Check.exe
- from %ProgramFiles%\ProVision\Agent\XCoveryTB\Rela1648.rra to %ProgramFiles%\ProVision\Agent\XCoveryTB\RelayServerIp.exe
- from %ProgramFiles%\ProVision\Agent\Prov1638.rra to %ProgramFiles%\ProVision\Agent\ProvisionSwDist.exe
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coreaef3.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctoraf9f.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objeb29c.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuseb348.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- from %CommonProgramFiles%\InstallShield\IScript\iscrb730.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setuc70f.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setup.inx
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\licec818.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\license.txt
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssvc867.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssver.scc
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\valuca1c.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\value.shl
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\isrtcb45.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\isrt.dll
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\defacc2f.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\default.pal
- from %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\_IsRcd1a.rra to %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\_IsRes.dll
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\layof34.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\layout.bin
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\dataf43.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\data1.hdr
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\dataf62.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\data1.cab
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setuf82.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setup.exe
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setufa1.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\Setup.ini
- from %ProgramFiles%\ProVision\Agent\Agen1510.rra to %ProgramFiles%\ProVision\Agent\AgentUI.dll
- from %ProgramFiles%\ProVision\Agent\prov1500.rra to %ProgramFiles%\ProVision\Agent\provision110408.bin
- from %ProgramFiles%\ProVision\Agent\Cafe14b2.rra to %ProgramFiles%\ProVision\Agent\CafevisionAgentRollback.exe
- from %ProgramFiles%\ProVision\Agent\Agen13b8.rra to %ProgramFiles%\ProVision\Agent\Agent.bak
- from %ProgramFiles%\ProVision\Agent\TBTo12fc.rra to %ProgramFiles%\ProVision\Agent\TBTools.exe
- from %ProgramFiles%\ProVision\Agent\proh12ed.rra to %ProgramFiles%\ProVision\Agent\prohooks.dll
- from %ProgramFiles%\ProVision\Agent\acts11c4.rra to %ProgramFiles%\ProVision\Agent\actsync.exe
- from %ProgramFiles%\ProVision\Agent\Cafe1202.rra to %ProgramFiles%\ProVision\Agent\CafevisionRC.exe
- from %ProgramFiles%\ProVision\Agent\SvcA11b4.rra to %ProgramFiles%\ProVision\Agent\SvcAgent.exe
- from %ProgramFiles%\ProVision\Agent\Powe11a5.rra to %ProgramFiles%\ProVision\Agent\Power.exe
- from %ProgramFiles%\ProVision\Agent\Agen106c.rra to %ProgramFiles%\ProVision\Agent\Agent.exe
- from %ProgramFiles%\ProVision\Agent\Upgr105c.rra to %ProgramFiles%\ProVision\Agent\Upgrade.exe
- from <SYSTEM32>\ActI100e.rra to <SYSTEM32>\ActIns.dll
- from %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setufb1.rra to %ProgramFiles%\InstallShield Installation Information\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\setup.inx
- from %ProgramFiles%\ProVision\Agent\NetC15bb.rra to %ProgramFiles%\ProVision\Agent\NetCloneLauncher.exe
- from %ProgramFiles%\RenoSoft\XCovery\Auto1dba.rra to %ProgramFiles%\RenoSoft\XCovery\AutoUninst.exe
Substitutes the following files:
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\license.txt
- %TEMP%\{E60BD0FA-A2D0-40BA-A5E2-DE0BC5E0E860}\vssver.scc
Network activity:
Connects to:
- 'pv##.fcas.jp':12001
UDP:
- DNS ASK pv##.fcas.jp
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'ProVision Agent'
- ClassName: '' WindowName: 'DMS?G?[?W?F???g'
- ClassName: '' WindowName: 'DMSѓGЃ[ѓWѓFѓ“ѓg'
- ClassName: '' WindowName: 'Create Shield User'
- ClassName: '' WindowName: '%ProgramFiles%\ProVision\Agent\MG\MG-admin.exe'
Creates and executes the following:
- '%TEMP%\pft3.tmp\Disk1\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '<SYSTEM32>\UnAgent.exe' -appcomp
- '%ProgramFiles%\ProVision\Agent\Agent.exe' -setupqb
- '%ProgramFiles%\ProVision\Agent\TBTools.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c net stop "ProVision Agent Service"
- '<SYSTEM32>\cmd.exe' /c net stop "ProVision-RHost"
- '<SYSTEM32>\net1.exe' stop "ProVision Agent Service"
- '<SYSTEM32>\net1.exe' stop "ProVision-RHost"
