Technical Information
Modifies file system
Creates the following files
- %TEMP%\7zs2319.tmp\desktopcentralagent.msi
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-rds.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\chatframe.ico
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\console2.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\talkbackwidget.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\images\detected.png
- %ProgramFiles(x86)%\desktopcentral_agent\images\messagebox_warning.png
- %ProgramFiles(x86)%\desktopcentral_agent\bin\microsoftedge.admx
- %ProgramFiles(x86)%\desktopcentral_agent\rds\dc_rds.exe
- %ProgramFiles(x86)%\desktopcentral_agent\rds\filetransfer\dcfiletransfer.exe
- %ProgramFiles(x86)%\desktopcentral_agent\images\minimize.gif
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\talkbackwidget.swf
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-br.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\sspicon.ico
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\bit-locker.bat
- %ProgramFiles(x86)%\desktopcentral_agent\data\wmi-classes.xml
- %ProgramFiles(x86)%\desktopcentral_agent\bin\7z.dll
- %ProgramFiles(x86)%\desktopcentral_agent\bin\agent_binaries.7z
- %ProgramFiles(x86)%\desktopcentral_agent\images\dropdown.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\close_top_hover.gif
- %ProgramFiles(x86)%\desktopcentral_agent\bin\logger.conf
- %ProgramFiles(x86)%\desktopcentral_agent\data\configuration-settings-dc.xml
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-framework.xml
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\proxy.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\disableenableethernet.vbs
- %ProgramFiles(x86)%\desktopcentral_agent\licenses\license_libxml.txt
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\participantlist.swf
- %ProgramFiles(x86)%\desktopcentral_agent\bin\dcagentservice.exe
- %ProgramFiles(x86)%\desktopcentral_agent\logs\dcagentinstaller.log
- %ProgramFiles(x86)%\desktopcentral_agent\rds\zchangenotifier.dll
- %WINDIR%\syswow64\dclibxml2.dll
- %ProgramFiles(x86)%\desktopcentral_agent\images\dcmsghandler.ico
- %ProgramFiles(x86)%\desktopcentral_agent\images\history_ico.png
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-pm.xml
- %ProgramFiles(x86)%\desktopcentral_agent\bin\7za.exe
- %ProgramFiles(x86)%\desktopcentral_agent\bin\7z.exe
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\generalalerts.vbs
- %ProgramFiles(x86)%\desktopcentral_agent\images\hover.gif
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\invite.swf
- %ProgramFiles(x86)%\desktopcentral_agent\images\patch.png
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\tools.vbs
- %ProgramFiles(x86)%\desktopcentral_agent\images\x-icon.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\cold_normal.gif
- %ProgramFiles(x86)%\desktopcentral_agent\bin\agentqppmupgrader.exe
- %ProgramFiles(x86)%\desktopcentral_agent\images\minimize_hover.gif
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\alert.swf
- %ProgramFiles(x86)%\desktopcentral_agent\data\agentapplicationresources.properties
- %ProgramFiles(x86)%\desktopcentral_agent\images\hot_send.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\style_hot.png
- %ProgramFiles(x86)%\desktopcentral_agent\data\osdetection.json
- %ProgramFiles(x86)%\desktopcentral_agent\images\history.png
- %ProgramFiles(x86)%\desktopcentral_agent\bin\dumpcreator.dll
- %ProgramFiles(x86)%\desktopcentral_agent\certificates\csr.pem
- %ProgramFiles(x86)%\desktopcentral_agent\rds\agenthook.dll
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\invite.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\images\stamp_used.png
- %ProgramFiles(x86)%\desktopcentral_agent\images\approval_status.png
- %ProgramFiles(x86)%\desktopcentral_agent\rds\webrtcdll.dll
- %ProgramFiles(x86)%\desktopcentral_agent\images\dcannouncement.ico
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-onpremise.xml
- %ProgramFiles(x86)%\desktopcentral_agent\rds\libcurl.dll
- %ProgramFiles(x86)%\desktopcentral_agent\images\dropdown_hover.gif
- %ProgramFiles(x86)%\desktopcentral_agent\data\dynamic-variables.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\dropdownarrow.png
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-vul.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\hot_mover.gif
- %WINDIR%\syswow64\dcagenthttp.dll
- %ProgramFiles(x86)%\desktopcentral_agent\bin\clientauthhandler.dll
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-mc.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\announcement.png
- %ProgramFiles(x86)%\desktopcentral_agent\images\cold_send.gif
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\chat.rgn
- %BOOT_VOL%\boot\bcd
- %BOOT_VOL%\boot\bcd.log
- %WINDIR%\installer\739a6.mst
- %TEMP%\7zs2319.tmp\agentinstall.log
- %TEMP%\7zs2319.tmp\agentuninstall.log
- %TEMP%\7zs2319.tmp\desktopcentralagent.mst
- %TEMP%\7zs2319.tmp\migratetodc_op.bat
- %ProgramFiles(x86)%\desktopcentral_agent\images\messagebox_info.png
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-edb.xml
- %ProgramFiles(x86)%\desktopcentral_agent\bin\dcagentregister.exe
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\participantlist.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\toolbar.swf
- %ProgramFiles(x86)%\desktopcentral_agent\images\detected_sw.png
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\toolbar.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\alert.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\dcagent.dll
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\initcmd.bat
- %ProgramFiles(x86)%\desktopcentral_agent\images\default.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\remind_hover.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\dcicon16.ico
- %ProgramFiles(x86)%\desktopcentral_agent\dcconfig.exe
- %ProgramFiles(x86)%\desktopcentral_agent\bin\dcagentupgrader.exe
- %ProgramFiles(x86)%\desktopcentral_agent\images\close_top.gif
- %ProgramFiles(x86)%\desktopcentral_agent\images\style_cold.png
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\messagebox.vbs
- %ProgramFiles(x86)%\desktopcentral_agent\images\alert.png
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\chat.png
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\proxy.swf
- %ProgramFiles(x86)%\desktopcentral_agent\images\waiting.png
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\console1.rgn
- %ProgramFiles(x86)%\desktopcentral_agent\scripts\addtcpipport.vbs
- %ProgramFiles(x86)%\desktopcentral_agent\images\remind.gif
- %ProgramFiles(x86)%\desktopcentral_agent\rds\resource\console.swf
- %ProgramFiles(x86)%\desktopcentral_agent\data\data-dictionary-inv.xml
- %ProgramFiles(x86)%\desktopcentral_agent\images\waiting_aprvl.png
- %ProgramFiles(x86)%\desktopcentral_agent\certificates\key.pem
Moves the following files
- from %ProgramFiles(x86)%\desktopcentral_agent\images\style_cold.png to C:\config.msi\739ab.rbf
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Substitutes the following files
- %ProgramFiles(x86)%\desktopcentral_agent\images\style_cold.png
Network activity
Connects to
- 'microsoft.com':80
- 'oc##.#ectigo.com':80
- 'cr#.#ectigo.com':80
- '10.#3.40.24':8383
UDP
- DNS ASK microsoft.com
- DNS ASK oc##.#ectigo.com
- DNS ASK cr#.#ectigo.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\desktopcentral_agent\bin\dcagentregister.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c .\MigrateToDC_OP.bat
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "PROCESSOR_ARCHITECTURE"
- '%WINDIR%\syswow64\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "PROCESSOR_ARCHITECTURE"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdventNet\DesktopCentral\DCAgent" /v "DCOPMigrated"
- '%WINDIR%\syswow64\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdventNet\DesktopCentral\DCAgent" /v "DCOPMigrated"
- '%WINDIR%\syswow64\msiexec.exe' /x{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} /qn /lv Agentuninstall.log
- '%WINDIR%\syswow64\msiexec.exe' /i DesktopcentralAgent.msi TRANSFORMS="DesktopcentralAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Migration /qn /lv Agentinstall.log
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\DesktopCentral_Agent\dcagent.dll"
