Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Z_ITAgent' = '"%PROGRAM_FILES%\ITAssetAgent\bin\AssetMngUA.exe"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Z_ITAgent] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngRepair.exe
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngSC.exe
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngSTP.exe
- %PROGRAM_FILES%\ITAssetAgent\bin\AssetMngUAC.exe
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngGui.exe
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngNotify.exe
- %TEMP%\ITAsset.exe CREATE %PROGRAM_FILES%\ITAssetAgent
- %TEMP%\ITAsset.exe GET %TEMP%\ITAsset.ini
- <Current directory>\ITAssetAgentSetup.EXE /S /A
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngPeriod.exe
- %PROGRAM_FILES%\ITAssetAgent\bin\AssetMngAgent.exe
- %TEMP%\ITAsset.exe REG_HKLM
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\MCSTC3\MS04-040.def
- %WINDIR%\Temp\MCSTC3\MS05-011.def
- %WINDIR%\Temp\MCSTC3\MS04-034.def
- %WINDIR%\Temp\MCSTC3\MS04-037.def
- %WINDIR%\Temp\MCSTC3\MS05-019.def
- %WINDIR%\Temp\MCSTC3\MS05-026.def
- %WINDIR%\Temp\MCSTC3\MS05-013.def
- %WINDIR%\Temp\MCSTC3\MS05-015.def
- %WINDIR%\Temp\MCSTC3\MS04-012.def
- %WINDIR%\Temp\MCSTC3\MS04-013.def
- %WINDIR%\Temp\MCSTC3\MS03-049.def
- %WINDIR%\Temp\MCSTC3\MS04-011.def
- %WINDIR%\Temp\MCSTC3\MS04-028.def
- %WINDIR%\Temp\MCSTC3\MS04-032.def
- %WINDIR%\Temp\MCSTC3\MS04-022.def
- %WINDIR%\Temp\MCSTC3\MS04-023.def
- %WINDIR%\Temp\MCSTC3\MS06-015.def
- %WINDIR%\Temp\MCSTC3\MS06-023.def
- %WINDIR%\Temp\MCSTC3\MS06-002.def
- %WINDIR%\Temp\MCSTC3\MS06-014.def
- %WINDIR%\Temp\MCSTC3\MS06-035.def
- %WINDIR%\Temp\MCSTC3\MS06-036.def
- %WINDIR%\Temp\MCSTC3\MS06-024.def
- %WINDIR%\Temp\MCSTC3\MS06-025.def
- %WINDIR%\Temp\MCSTC3\MS05-039.def
- %WINDIR%\Temp\MCSTC3\MS05-043.def
- %WINDIR%\Temp\MCSTC3\MS05-027.def
- %WINDIR%\Temp\MCSTC3\MS05-036.def
- %WINDIR%\Temp\MCSTC3\MS05-053.def
- %WINDIR%\Temp\MCSTC3\MS06-001.def
- %WINDIR%\Temp\MCSTC3\MS05-050.def
- %WINDIR%\Temp\MCSTC3\MS05-051.def
- %WINDIR%\Temp\MCSTC2\MS08-067.def
- %WINDIR%\Temp\MCSTC2\MS08-069-1.def
- %WINDIR%\Temp\MCSTC2\MS08-052-3.def
- %WINDIR%\Temp\MCSTC2\MS08-052-4.def
- %WINDIR%\Temp\MCSTC2\MS08-075-1.def
- %WINDIR%\Temp\MCSTC2\MS08-075-2.def
- %WINDIR%\Temp\MCSTC2\MS08-071.def
- %WINDIR%\Temp\MCSTC2\MS08-073.def
- %WINDIR%\Temp\MCSTC2\MS08-028.def
- %WINDIR%\Temp\MCSTC2\MS08-033.def
- %WINDIR%\Temp\MCSTC2\MS08-022.def
- %WINDIR%\Temp\MCSTC2\MS08-023.def
- %WINDIR%\Temp\MCSTC2\MS08-052-1.def
- %WINDIR%\Temp\MCSTC2\MS08-052-2.def
- %WINDIR%\Temp\MCSTC2\MS08-030.def
- %WINDIR%\Temp\MCSTC2\MS08-046.def
- %WINDIR%\Temp\MCSTC3\MS03-023.def
- %WINDIR%\Temp\MCSTC3\MS03-024.def
- %WINDIR%\Temp\MCSTC3\MS02-050.def
- %WINDIR%\Temp\MCSTC3\MS03-007.def
- %WINDIR%\Temp\MCSTC3\MS03-043.def
- %WINDIR%\Temp\MCSTC3\MS03-044.def
- %WINDIR%\Temp\MCSTC3\MS03-041.def
- %WINDIR%\Temp\MCSTC3\MS03-042.def
- %WINDIR%\Temp\MCSTC2\MS09-002.def
- %WINDIR%\Temp\MCSTC2\MS09-006.def
- %WINDIR%\Temp\MCSTC2\MS08-078.def
- %WINDIR%\Temp\MCSTC2\MS09-001.def
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngSTP.pid
- %WINDIR%\Temp\MCSTC3\MS02-045.def
- %WINDIR%\Temp\MCSTC2\$
- %WINDIR%\Temp\MCSTC2\mcste.ini
- %WINDIR%\Temp\MCSTC3\MS08-071.def
- %WINDIR%\Temp\MCSTC3\MS08-073.def
- %WINDIR%\Temp\MCSTC3\MS08-067.def
- %WINDIR%\Temp\MCSTC3\MS08-069-1.def
- %WINDIR%\Temp\MCSTC3\MS08-078.def
- %WINDIR%\Temp\MCSTC3\MS09-001.def
- %WINDIR%\Temp\MCSTC3\MS08-075-1.def
- %WINDIR%\Temp\MCSTC3\MS08-075-2.def
- %WINDIR%\Temp\MCSTC3\MS08-030.def
- %WINDIR%\Temp\MCSTC3\MS08-046.def
- %WINDIR%\Temp\MCSTC3\MS08-028.def
- %WINDIR%\Temp\MCSTC3\MS08-033.def
- %WINDIR%\Temp\MCSTC3\MS08-052-3.def
- %WINDIR%\Temp\MCSTC3\MS08-052-4.def
- %WINDIR%\Temp\MCSTC3\MS08-052-1.def
- %WINDIR%\Temp\MCSTC3\MS08-052-2.def
- %PROGRAM_FILES%\ITAssetAgent\bin\ASSETM~2.pid
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngGui.pid
- %WINDIR%\Temp\mc8.tmp
- %WINDIR%\Temp\mc9.tmp
- %PROGRAM_FILES%\ITAssetAgent\bin\AssetMngUAC.pid
- %PROGRAM_FILES%\ITAssetAgent\data\patch\sdic.dat
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngUAC.log
- %TEMP%\mcA.tmp
- %WINDIR%\Temp\MCSTC3\MS09-006.def
- %PROGRAM_FILES%\ITAssetAgent\data\CustomInfo.txt.temp
- %WINDIR%\Temp\mc7.tmp
- %WINDIR%\Temp\MCSTC3\MS09-002.def
- %PROGRAM_FILES%\ITAssetAgent\log\MCSTE.log
- %PROGRAM_FILES%\ITAssetAgent\data\4EC17B0A000000000001.dat
- %WINDIR%\Temp\MCSTC3\$
- %WINDIR%\Temp\MCSTC3\mcste.ini
- %WINDIR%\Temp\MCSTC3\MS06-070.def
- %WINDIR%\Temp\MCSTC3\MS06-078-1.def
- %WINDIR%\Temp\MCSTC3\MS06-061-1.def
- %WINDIR%\Temp\MCSTC3\MS06-068.def
- %WINDIR%\Temp\MCSTC3\MS07-009.def
- %WINDIR%\Temp\MCSTC3\MS07-017.def
- %WINDIR%\Temp\MCSTC3\MS06-078-2.def
- %WINDIR%\Temp\MCSTC3\MS07-008.def
- %WINDIR%\Temp\MCSTC3\MS06-042.def
- %WINDIR%\Temp\MCSTC3\MS06-044.def
- %WINDIR%\Temp\MCSTC3\MS06-040.def
- %WINDIR%\Temp\MCSTC3\MS06-041.def
- %WINDIR%\Temp\MCSTC3\MS06-055.def
- %WINDIR%\Temp\MCSTC3\MS06-057.def
- %WINDIR%\Temp\MCSTC3\MS06-046.def
- %WINDIR%\Temp\MCSTC3\MS06-051.def
- %WINDIR%\Temp\MCSTC3\MS07-068.def
- %WINDIR%\Temp\MCSTC3\MS08-001.def
- %WINDIR%\Temp\MCSTC3\MS07-056.def
- %WINDIR%\Temp\MCSTC3\MS07-061.def
- %WINDIR%\Temp\MCSTC3\MS08-022.def
- %WINDIR%\Temp\MCSTC3\MS08-023.def
- %WINDIR%\Temp\MCSTC3\MS08-007.def
- %WINDIR%\Temp\MCSTC3\MS08-008.def
- %WINDIR%\Temp\MCSTC3\MS07-021.def
- %WINDIR%\Temp\MCSTC3\MS07-034.def
- %WINDIR%\Temp\MCSTC3\MS07-019.def
- %WINDIR%\Temp\MCSTC3\MS07-020.def
- %WINDIR%\Temp\MCSTC3\MS07-051.def
- %WINDIR%\Temp\MCSTC3\MS07-055.def
- %WINDIR%\Temp\MCSTC3\MS07-035.def
- %WINDIR%\Temp\MCSTC3\MS07-050.def
- %WINDIR%\Temp\MCSTC2\MS08-008.def
- %PROGRAM_FILES%\ITAssetAgent\INSTALL.LOG
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngAgent.log
- %PROGRAM_FILES%\ITAssetAgent\bin\AssetMngAgent.pid
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngRepair.log
- %PROGRAM_FILES%\ITAssetAgent\log\MCCipher.log
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngUA.log
- %PROGRAM_FILES%\ITAssetAgent\data\SystemInfo.txt
- %PROGRAM_FILES%\ITAssetAgent\config\~GLH002b.TMP
- %PROGRAM_FILES%\ITAssetAgent\log\Update.log
- %PROGRAM_FILES%\ITAssetAgent\config\~GLH0029.TMP
- %PROGRAM_FILES%\ITAssetAgent\config\~GLH002a.TMP
- %PROGRAM_FILES%\ITAssetAgent\ITAsset.ini
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngRestart.log
- %ALLUSERSPROFILE%\Start Menu\Programs\ManagementCore\ITЋ‘ЋYЉЗ—ќѓGЃ[ѓWѓFѓ“ѓg.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ManagementCore\ITЋ‘ЋYЉЗ—ќѓGЃ[ѓWѓFѓ“ѓg‘—ђMѓcЃ[ѓ‹.lnk
- %WINDIR%\Temp\MCSTC2\MS03-007.def
- %WINDIR%\Temp\MCSTC2\MS03-023.def
- %WINDIR%\Temp\MCSTC2\MS02-045.def
- %WINDIR%\Temp\MCSTC2\MS02-050.def
- %WINDIR%\Temp\MCSTC2\MS03-041.def
- %WINDIR%\Temp\MCSTC2\MS03-042.def
- %WINDIR%\Temp\MCSTC2\MS03-024.def
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngNotify.pid
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngNotify.log
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngLib.log
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngSC.log
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngRepair.pid
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngPeriod.log
- %PROGRAM_FILES%\ITAssetAgent\log\AssetMngSTP.log
- %PROGRAM_FILES%\ITAssetAgent\plugins\AssetMngSC.pid
- <SYSTEM32>\MCAssetMngData.ini
- %PROGRAM_FILES%\ITAssetAgent\~GLH0002.TMP
- %PROGRAM_FILES%\ITAssetAgent\temp.000
- %TEMP%\~GLH0001.TMP
- %TEMP%\ITAsset.ini
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0006.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0008.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0004.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\temp.000
- <Current directory>\ITAssetAgentSetup.EXE
- <Current directory>\20080828.PickupInfo.ini
- <Current directory>\20090114.AssetMngAgent.ini
- <Current directory>\20090323132339.sdic.ini
- %TEMP%\GLG4.tmp
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLC1.tmp
- %TEMP%\GLK2.tmp
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001c.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001e.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0018.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001a.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0025.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0027.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0020.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0022.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH000e.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\temp.000
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH000a.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH000c.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0014.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0016.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0010.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0012.TMP
- %WINDIR%\Temp\MCSTC2\MS06-057.def
- %WINDIR%\Temp\MCSTC2\MS06-061-1.def
- %WINDIR%\Temp\MCSTC2\MS06-051.def
- %WINDIR%\Temp\MCSTC2\MS06-055.def
- %WINDIR%\Temp\MCSTC2\MS06-078-1.def
- %WINDIR%\Temp\MCSTC2\MS06-078-2.def
- %WINDIR%\Temp\MCSTC2\MS06-068.def
- %WINDIR%\Temp\MCSTC2\MS06-070.def
- %WINDIR%\Temp\MCSTC2\MS06-036.def
- %WINDIR%\Temp\MCSTC2\MS06-040.def
- %WINDIR%\Temp\MCSTC2\MS06-025.def
- %WINDIR%\Temp\MCSTC2\MS06-035.def
- %WINDIR%\Temp\MCSTC2\MS06-044.def
- %WINDIR%\Temp\MCSTC2\MS06-046.def
- %WINDIR%\Temp\MCSTC2\MS06-041.def
- %WINDIR%\Temp\MCSTC2\MS06-042.def
- %WINDIR%\Temp\MCSTC2\MS07-055.def
- %WINDIR%\Temp\MCSTC2\MS07-056.def
- %WINDIR%\Temp\MCSTC2\MS07-050.def
- %WINDIR%\Temp\MCSTC2\MS07-051.def
- %WINDIR%\Temp\MCSTC2\MS08-001.def
- %WINDIR%\Temp\MCSTC2\MS08-007.def
- %WINDIR%\Temp\MCSTC2\MS07-061.def
- %WINDIR%\Temp\MCSTC2\MS07-068.def
- %WINDIR%\Temp\MCSTC2\MS07-017.def
- %WINDIR%\Temp\MCSTC2\MS07-019.def
- %WINDIR%\Temp\MCSTC2\MS07-008.def
- %WINDIR%\Temp\MCSTC2\MS07-009.def
- %WINDIR%\Temp\MCSTC2\MS07-034.def
- %WINDIR%\Temp\MCSTC2\MS07-035.def
- %WINDIR%\Temp\MCSTC2\MS07-020.def
- %WINDIR%\Temp\MCSTC2\MS07-021.def
- %WINDIR%\Temp\MCSTC2\MS04-032.def
- %WINDIR%\Temp\MCSTC2\MS04-034.def
- %WINDIR%\Temp\MCSTC2\MS04-023.def
- %WINDIR%\Temp\MCSTC2\MS04-028.def
- %WINDIR%\Temp\MCSTC2\MS05-011.def
- %WINDIR%\Temp\MCSTC2\MS05-013.def
- %WINDIR%\Temp\MCSTC2\MS04-037.def
- %WINDIR%\Temp\MCSTC2\MS04-040.def
- %WINDIR%\Temp\MCSTC2\MS03-049.def
- %WINDIR%\Temp\MCSTC2\MS04-011.def
- %WINDIR%\Temp\MCSTC2\MS03-043.def
- %WINDIR%\Temp\MCSTC2\MS03-044.def
- %WINDIR%\Temp\MCSTC2\MS04-013.def
- %WINDIR%\Temp\MCSTC2\MS04-022.def
- %WINDIR%\Temp\mc6.tmp
- %WINDIR%\Temp\MCSTC2\MS04-012.def
- %WINDIR%\Temp\MCSTC2\MS06-001.def
- %WINDIR%\Temp\MCSTC2\MS06-002.def
- %WINDIR%\Temp\MCSTC2\MS05-051.def
- %WINDIR%\Temp\MCSTC2\MS05-053.def
- %WINDIR%\Temp\MCSTC2\MS06-023.def
- %WINDIR%\Temp\MCSTC2\MS06-024.def
- %WINDIR%\Temp\MCSTC2\MS06-014.def
- %WINDIR%\Temp\MCSTC2\MS06-015.def
- %WINDIR%\Temp\MCSTC2\MS05-026.def
- %WINDIR%\Temp\MCSTC2\MS05-027.def
- %WINDIR%\Temp\MCSTC2\MS05-015.def
- %WINDIR%\Temp\MCSTC2\MS05-019.def
- %WINDIR%\Temp\MCSTC2\MS05-043.def
- %WINDIR%\Temp\MCSTC2\MS05-050.def
- %WINDIR%\Temp\MCSTC2\MS05-036.def
- %WINDIR%\Temp\MCSTC2\MS05-039.def
Deletes the following files:
- %WINDIR%\Temp\MCSTC2\MS07-009.def
- %WINDIR%\Temp\MCSTC2\MS07-008.def
- %WINDIR%\Temp\MCSTC2\MS07-019.def
- %WINDIR%\Temp\MCSTC2\MS07-017.def
- %WINDIR%\Temp\MCSTC2\MS06-070.def
- %WINDIR%\Temp\MCSTC2\MS06-068.def
- %WINDIR%\Temp\MCSTC2\MS06-078-2.def
- %WINDIR%\Temp\MCSTC2\MS06-078-1.def
- %WINDIR%\Temp\MCSTC2\MS07-051.def
- %WINDIR%\Temp\MCSTC2\MS07-050.def
- %WINDIR%\Temp\MCSTC2\MS07-056.def
- %WINDIR%\Temp\MCSTC2\MS07-055.def
- %WINDIR%\Temp\MCSTC2\MS07-021.def
- %WINDIR%\Temp\MCSTC2\MS07-020.def
- %WINDIR%\Temp\MCSTC2\MS07-035.def
- %WINDIR%\Temp\MCSTC2\MS07-034.def
- %WINDIR%\Temp\MCSTC2\MS06-035.def
- %WINDIR%\Temp\MCSTC2\MS06-025.def
- %WINDIR%\Temp\MCSTC2\MS06-040.def
- %WINDIR%\Temp\MCSTC2\MS06-036.def
- %WINDIR%\Temp\MCSTC2\MS06-015.def
- %WINDIR%\Temp\MCSTC2\MS06-014.def
- %WINDIR%\Temp\MCSTC2\MS06-024.def
- %WINDIR%\Temp\MCSTC2\MS06-023.def
- %WINDIR%\Temp\MCSTC2\MS06-055.def
- %WINDIR%\Temp\MCSTC2\MS06-051.def
- %WINDIR%\Temp\MCSTC2\MS06-061-1.def
- %WINDIR%\Temp\MCSTC2\MS06-057.def
- %WINDIR%\Temp\MCSTC2\MS06-042.def
- %WINDIR%\Temp\MCSTC2\MS06-041.def
- %WINDIR%\Temp\MCSTC2\MS06-046.def
- %WINDIR%\Temp\MCSTC2\MS06-044.def
- %WINDIR%\Temp\MCSTC2\MS08-078.def
- %WINDIR%\Temp\MCSTC2\MS08-075-2.def
- %WINDIR%\Temp\MCSTC2\MS09-002.def
- %WINDIR%\Temp\MCSTC2\MS09-001.def
- %WINDIR%\Temp\MCSTC2\MS08-071.def
- %WINDIR%\Temp\MCSTC2\MS08-069-1.def
- %WINDIR%\Temp\MCSTC2\MS08-075-1.def
- %WINDIR%\Temp\MCSTC2\MS08-073.def
- %WINDIR%\Temp\mc9.tmp
- %WINDIR%\Temp\mc8.tmp
- %TEMP%\mcA.tmp
- %PROGRAM_FILES%\ITAssetAgent\data\CustomInfo.txt.temp
- %WINDIR%\Temp\mc7.tmp
- %WINDIR%\Temp\MCSTC2\MS09-006.def
- %PROGRAM_FILES%\ITAssetAgent\data\4EC17B0A000000000001.dat
- %WINDIR%\Temp\mc6.tmp
- %WINDIR%\Temp\MCSTC2\MS08-022.def
- %WINDIR%\Temp\MCSTC2\MS08-008.def
- %WINDIR%\Temp\MCSTC2\MS08-028.def
- %WINDIR%\Temp\MCSTC2\MS08-023.def
- %WINDIR%\Temp\MCSTC2\MS07-068.def
- %WINDIR%\Temp\MCSTC2\MS07-061.def
- %WINDIR%\Temp\MCSTC2\MS08-007.def
- %WINDIR%\Temp\MCSTC2\MS08-001.def
- %WINDIR%\Temp\MCSTC2\MS08-052-3.def
- %WINDIR%\Temp\MCSTC2\MS08-052-2.def
- %WINDIR%\Temp\MCSTC2\MS08-067.def
- %WINDIR%\Temp\MCSTC2\MS08-052-4.def
- %WINDIR%\Temp\MCSTC2\MS08-033.def
- %WINDIR%\Temp\MCSTC2\MS08-030.def
- %WINDIR%\Temp\MCSTC2\MS08-052-1.def
- %WINDIR%\Temp\MCSTC2\MS08-046.def
- %WINDIR%\Temp\MCSTC2\MS06-002.def
- %TEMP%\GLG4.tmp
- %TEMP%\ITAsset.exe
- %TEMP%\GLF5.tmp
- %TEMP%\GLK2.tmp
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0025.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0022.TMP
- %TEMP%\ITAsset.ini
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0027.TMP
- %WINDIR%\Temp\MCSTC2\$
- <Current directory>\20090114.AssetMngAgent.ini
- %WINDIR%\Temp\MCSTC2\MS02-045.def
- %WINDIR%\Temp\MCSTC2\mcste.ini
- <Current directory>\20080828.PickupInfo.ini
- %TEMP%\GLC1.tmp
- <Current directory>\20090323132339.sdic.ini
- <Current directory>\ITAssetAgentSetup.EXE
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH000c.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH000a.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0010.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH000e.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0004.TMP
- %PROGRAM_FILES%\ITAssetAgent\~GLH0002.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0008.TMP
- %PROGRAM_FILES%\ITAssetAgent\bin\~GLH0006.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001c.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001a.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0020.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH001e.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0014.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0012.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0018.TMP
- %PROGRAM_FILES%\ITAssetAgent\plugins\~GLH0016.TMP
- %WINDIR%\Temp\MCSTC2\MS05-015.def
- %WINDIR%\Temp\MCSTC2\MS05-013.def
- %WINDIR%\Temp\MCSTC2\MS05-026.def
- %WINDIR%\Temp\MCSTC2\MS05-019.def
- %WINDIR%\Temp\MCSTC2\MS04-037.def
- %WINDIR%\Temp\MCSTC2\MS04-034.def
- %WINDIR%\Temp\MCSTC2\MS05-011.def
- %WINDIR%\Temp\MCSTC2\MS04-040.def
- %WINDIR%\Temp\MCSTC2\MS05-051.def
- %WINDIR%\Temp\MCSTC2\MS05-050.def
- %WINDIR%\Temp\MCSTC2\MS06-001.def
- %WINDIR%\Temp\MCSTC2\MS05-053.def
- %WINDIR%\Temp\MCSTC2\MS05-036.def
- %WINDIR%\Temp\MCSTC2\MS05-027.def
- %WINDIR%\Temp\MCSTC2\MS05-043.def
- %WINDIR%\Temp\MCSTC2\MS05-039.def
- %WINDIR%\Temp\MCSTC2\MS03-042.def
- %WINDIR%\Temp\MCSTC2\MS03-041.def
- %WINDIR%\Temp\MCSTC2\MS03-044.def
- %WINDIR%\Temp\MCSTC2\MS03-043.def
- %WINDIR%\Temp\MCSTC2\MS03-007.def
- %WINDIR%\Temp\MCSTC2\MS02-050.def
- %WINDIR%\Temp\MCSTC2\MS03-024.def
- %WINDIR%\Temp\MCSTC2\MS03-023.def
- %WINDIR%\Temp\MCSTC2\MS04-023.def
- %WINDIR%\Temp\MCSTC2\MS04-022.def
- %WINDIR%\Temp\MCSTC2\MS04-032.def
- %WINDIR%\Temp\MCSTC2\MS04-028.def
- %WINDIR%\Temp\MCSTC2\MS04-011.def
- %WINDIR%\Temp\MCSTC2\MS03-049.def
- %WINDIR%\Temp\MCSTC2\MS04-013.def
- %WINDIR%\Temp\MCSTC2\MS04-012.def
Network activity:
Connects to:
- '13#.#66.197.10':21
- '13#.#66.197.10':21001
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'AssetMngSTP.MainWindow'
- ClassName: '' WindowName: 'AssetMngSC.MainWindow'
- ClassName: 'AssetMngUA.MainWindow' WindowName: 'AssetMngUA.MainWindow'
- ClassName: 'AssetMngMA.MainWindow' WindowName: 'AssetMngMA.MainWindow'
- ClassName: 'AssetMngUAC.MainWindow' WindowName: 'AssetMngUAC.MainWindow'
- ClassName: '' WindowName: 'AssetMngRepair.MainWindow'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'AssetMngQua.MainWindow'
- ClassName: '' WindowName: 'AssetMngNotify.MainWindow'
- ClassName: '' WindowName: 'AssetMngPeriod.MainWindow'
