HackTool.Win32.RAdmin.F

January 30, 2026

Analysis by: Raymart Christian Yambot

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Hacking Tool
Destructiveness: No
Encrypted: No
In the wild: Yes

TECHNICAL DETAILS

File Size: 14,781,984 bytes

File Type: EXE

File Compression: ZIP SFX

Memory Resident: No

Initial Samples Received Date: 30 Jan 2026

Installation

This Hacking Tool drops the following files:

%Program Files%\Advanced Monitoring Agent\unins000.exe
%Program Files%\Advanced Monitoring Agent\1.lng
%Program Files%\Advanced Monitoring Agent\2.lng
%Program Files%\Advanced Monitoring Agent\3.lng
%Program Files%\Advanced Monitoring Agent\4.lng
%Program Files%\Advanced Monitoring Agent\5.lng
%Program Files%\Advanced Monitoring Agent\6.lng
%Program Files%\Advanced Monitoring Agent\2000.lng
%Program Files%\Advanced Monitoring Agent\services.ini
%Program Files%\Advanced Monitoring Agent\assetscan.exe
%Program Files%\Advanced Monitoring Agent\PavApi.dll
%Program Files%\Advanced Monitoring Agent\pavcomm.dll
%Program Files%\Advanced Monitoring Agent\_avg7api.dll
%Program Files%\Advanced Monitoring Agent\winagent.exe
%Program Files%\Advanced Monitoring Agent\wsus.exe
%Program Files%\Advanced Monitoring Agent\wsus2.exe
%Program Files%\Advanced Monitoring Agent\wsus3.exe
%Program Files%\Advanced Monitoring Agent\iscanruntime.exe
%Program Files%\Advanced Monitoring Agent\package.zip
%Program Files%\Advanced Monitoring Agent\unzip.exe
%Program Files%\Advanced Monitoring Agent\task_start.js
%Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe
%Program Files%\Advanced Monitoring Agent\featureres\msp-agent-core.msi
%Common Programs%\Advanced Monitoring Agent.lnk
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp
%User Temp%\is-{Random 5 Characters}.tmp\agent.tmp
%User Temp%\is-{Random 5 Characters}.tmp\_isetup\_shfoldr.dll
%Program Files%\Advanced Monitoring Agent\featureres\is-{Random 5 Characters}.tmp
%Program Files%\Advanced Monitoring Agent\unins000.dat
%Program Files%\Advanced Monitoring Agent\settings.ini
%Program Files%\Advanced Monitoring Agent\debug.log
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

"%User Temp%\7ZipSfx.000\agent.exe" /VERYSILENT /norestart
"%User Temp%\is-{Random 5 Characters}.tmp\agent.tmp" /SL5="{Inno Setup Parameter},%User Temp%\7ZipSfx.000\agent.exe" /VERYSILENT /norestart "%Program Files%\Advanced Monitoring Agent\unzip.exe" package.zip
"%Program Files%\Advanced Monitoring Agent\unzip.exe" package.zip
"%Program Files%\Advanced Monitoring Agent\unzip.exe"
"%Program Files%\Advanced Monitoring Agent\winagent.exe" /autoinstall

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Hacking Tool adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
Inno Setup: Setup Version = 5.5.3 (a)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
Inno Setup: App Path = %Program Files%\Advanced Monitoring Agent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
InstallLocation = %Program Files%\Advanced Monitoring Agent\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
Inno Setup: Icon Group = Advanced Monitoring Agent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
Inno Setup: User = {Username}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
Inno Setup: Language = UKEnglish

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
DisplayName = Advanced Monitoring Agent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
UninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
QuietUninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
InstallDate = 20260130

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1
EstimatedSize = 31745

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32
ThreadingModel = Both

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = %Program Files%\Advanced Monitoring Agent\assetscan.exe, %Program Files%\Advanced Monitoring Agent\PavApi.dll, %Program Files%\Advanced Monitoring Agent\pavcomm.dll, %Program Files%\Advanced Monitoring Agent\_avg7api.dll, %Program Files%\Advanced Monitoring Agent\winagent.exe, %Program Files%\Advanced Monitoring Agent\wsus.exe, %Program Files%\Advanced Monitoring Agent\wsus2.exe, %Program Files%\Advanced Monitoring Agent\wsus3.exe, %Program Files%\Advanced Monitoring Agent\iscanruntime.exe, %Program Files%\Advanced Monitoring Agent\unzip.exe, %Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe

Backdoor Routine

This Hacking Tool connects to the following URL(s) to send and receive commands from a remote malicious user:

https://{BLOCKED}1.am.remote.management
https://{BLOCKED}2.am.remote.management
https://{BLOCKED}3.am.remote.management
https://{BLOCKED}4.am.remote.management

Other Details

This Hacking Tool adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Advanced Monitoring Agent_is1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID}\InprocServer32

SOLUTION

Minimum Scan Engine: 9.800

FIRST VSAPI PATTERN FILE: 2.915.00

FIRST VSAPI PATTERN DATE: 30 Jan 2026

VSAPI OPR PATTERN File: 2.916.00

VSAPI OPR PATTERN Date: 31 Jan 2026

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32

Step 4

Delete this registry value

[ Learn More ]

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFiles0000 = %Program Files%\Advanced Monitoring Agent\assetscan.exe, %Program Files%\Advanced Monitoring Agent\PavApi.dll, %Program Files%\Advanced Monitoring Agent\pavcomm.dll, %Program Files%\Advanced Monitoring Agent\_avg7api.dll, %Program Files%\Advanced Monitoring Agent\winagent.exe, %Program Files%\Advanced Monitoring Agent\wsus.exe, %Program Files%\Advanced Monitoring Agent\wsus2.exe, %Program Files%\Advanced Monitoring Agent\wsus3.exe, %Program Files%\Advanced Monitoring Agent\iscanruntime.exe, %Program Files%\Advanced Monitoring Agent\unzip.exe, %Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- Inno Setup: Setup Version = 5.5.3 (a)
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- Inno Setup: App Path = %Program Files%\Advanced Monitoring Agent
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- InstallLocation = %Program Files%\Advanced Monitoring Agent\
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- Inno Setup: Icon Group = Advanced Monitoring Agent
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- Inno Setup: User = dyituser_732
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- Inno Setup: Language = UKEnglish
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- DisplayName = Advanced Monitoring Agent
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- UninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- QuietUninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe" /SILENT
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- NoModify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- NoRepair = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- InstallDate = 20260130
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Monitoring Agent_is1
- EstimatedSize = 31745
- 13:39:51:8803892%Program Files%\Advanced Monitoring Agent\winagent.exeset registry value
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32
- ThreadingModel = Both

To delete the registry value this malware created:

Open Registry Editor. To do this:
» For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>RestartManager>Session0000
In the right panel, locate and delete the entry:
RegFiles0000 = %Program Files%\Advanced Monitoring Agent\assetscan.exe, %Program Files%\Advanced Monitoring Agent\PavApi.dll, %Program Files%\Advanced Monitoring Agent\pavcomm.dll, %Program Files%\Advanced Monitoring Agent\_avg7api.dll, %Program Files%\Advanced Monitoring Agent\winagent.exe, %Program Files%\Advanced Monitoring Agent\wsus.exe, %Program Files%\Advanced Monitoring Agent\wsus2.exe, %Program Files%\Advanced Monitoring Agent\wsus3.exe, %Program Files%\Advanced Monitoring Agent\iscanruntime.exe, %Program Files%\Advanced Monitoring Agent\unzip.exe, %Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Advanced Monitoring Agent_is1
In the right panel, locate and delete the entry:
Inno Setup: Setup Version = 5.5.3 (a)
Again In the right panel, locate and delete the entry:
Inno Setup: App Path = %Program Files%\Advanced Monitoring Agent
Again In the right panel, locate and delete the entry:
InstallLocation = %Program Files%\Advanced Monitoring Agent\
Again In the right panel, locate and delete the entry:
Inno Setup: Icon Group = Advanced Monitoring Agent
Again In the right panel, locate and delete the entry:
Inno Setup: User = dyituser_732
Again In the right panel, locate and delete the entry:
Inno Setup: Language = UKEnglish
Again In the right panel, locate and delete the entry:
DisplayName = Advanced Monitoring Agent
Again In the right panel, locate and delete the entry:
UninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe"
Again In the right panel, locate and delete the entry:
QuietUninstallString = "%Program Files%\Advanced Monitoring Agent\unins000.exe" /SILENT
Again In the right panel, locate and delete the entry:
NoModify = 1
Again In the right panel, locate and delete the entry:
NoRepair = 1
Again In the right panel, locate and delete the entry:
InstallDate = 20260130
Again In the right panel, locate and delete the entry:
EstimatedSize = 31745
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{GUID}>InprocServer32
In the right panel, locate and delete the entry:
ThreadingModel = Both
Close Registry Editor.

Step 5

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Program Files%\Advanced Monitoring Agent\unins000.exe
%Program Files%\Advanced Monitoring Agent\1.lng
%Program Files%\Advanced Monitoring Agent\2.lng
%Program Files%\Advanced Monitoring Agent\3.lng
%Program Files%\Advanced Monitoring Agent\4.lng
%Program Files%\Advanced Monitoring Agent\5.lng
%Program Files%\Advanced Monitoring Agent\6.lng
%Program Files%\Advanced Monitoring Agent\2000.lng
%Program Files%\Advanced Monitoring Agent\services.ini
%Program Files%\Advanced Monitoring Agent\assetscan.exe
%Program Files%\Advanced Monitoring Agent\PavApi.dll
%Program Files%\Advanced Monitoring Agent\pavcomm.dll
%Program Files%\Advanced Monitoring Agent\_avg7api.dll
%Program Files%\Advanced Monitoring Agent\winagent.exe
%Program Files%\Advanced Monitoring Agent\wsus.exe
%Program Files%\Advanced Monitoring Agent\wsus2.exe
%Program Files%\Advanced Monitoring Agent\wsus3.exe
%Program Files%\Advanced Monitoring Agent\iscanruntime.exe
%Program Files%\Advanced Monitoring Agent\package.zip
%Program Files%\Advanced Monitoring Agent\unzip.exe
%Program Files%\Advanced Monitoring Agent\task_start.js
%Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe
%Program Files%\Advanced Monitoring Agent\featureres\msp-agent-core.msi
%Common Programs%\Advanced Monitoring Agent.lnk
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp
%User Temp%\is-7JTRH.tmp\agent.tmp
%User Temp%\is-G89E5.tmp\_isetup\_shfoldr.dll
%Program Files%\Advanced Monitoring Agent\featureres\is-{Random 5 Characters}.tmp
%Program Files%\Advanced Monitoring Agent\unins000.dat
%Program Files%\Advanced Monitoring Agent\settings.ini
%Program Files%\Advanced Monitoring Agent\debug.log
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp

To delete malware/grayware files:

For Windows 7 and Server 2008 (R2), 8, 8.1, 10, and Server 2012 (R2):

Open a Windows Explorer window.
- For Windows 7 and Server 2008 (R2) users, click Start>Computer.
- For Windows 8, 8.1, 10, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
In the Search Computer/This PC input box, type:
%Program Files%\Advanced Monitoring Agent\unins000.exe
%Program Files%\Advanced Monitoring Agent\1.lng
%Program Files%\Advanced Monitoring Agent\2.lng
%Program Files%\Advanced Monitoring Agent\3.lng
%Program Files%\Advanced Monitoring Agent\4.lng
%Program Files%\Advanced Monitoring Agent\5.lng
%Program Files%\Advanced Monitoring Agent\6.lng
%Program Files%\Advanced Monitoring Agent\2000.lng
%Program Files%\Advanced Monitoring Agent\services.ini
%Program Files%\Advanced Monitoring Agent\assetscan.exe
%Program Files%\Advanced Monitoring Agent\PavApi.dll
%Program Files%\Advanced Monitoring Agent\pavcomm.dll
%Program Files%\Advanced Monitoring Agent\_avg7api.dll
%Program Files%\Advanced Monitoring Agent\winagent.exe
%Program Files%\Advanced Monitoring Agent\wsus.exe
%Program Files%\Advanced Monitoring Agent\wsus2.exe
%Program Files%\Advanced Monitoring Agent\wsus3.exe
%Program Files%\Advanced Monitoring Agent\iscanruntime.exe
%Program Files%\Advanced Monitoring Agent\package.zip
%Program Files%\Advanced Monitoring Agent\unzip.exe
%Program Files%\Advanced Monitoring Agent\task_start.js
%Program Files%\Advanced Monitoring Agent\ResourceUpdateService\ResourceUpdateService.exe
%Program Files%\Advanced Monitoring Agent\featureres\msp-agent-core.msi
%Common Programs%\Advanced Monitoring Agent.lnk
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp
%User Temp%\is-7JTRH.tmp\agent.tmp
%User Temp%\is-G89E5.tmp\_isetup\_shfoldr.dll
%Program Files%\Advanced Monitoring Agent\featureres\is-{Random 5 Characters}.tmp
%Program Files%\Advanced Monitoring Agent\unins000.dat
%Program Files%\Advanced Monitoring Agent\settings.ini
%Program Files%\Advanced Monitoring Agent\debug.log
%Program Files%\Advanced Monitoring Agent\is-{Random 5 Characters}.tmp
Once located, select the file then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.
*Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).

Step 6

Scan your computer with your Trend Micro product to delete files detected as HackTool.Win32.RAdmin.F. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Did this description help? Tell us how we did.

HackTool.Win32.RAdmin.F

TECHNICAL DETAILS

SOLUTION

Trend Vision One™ - Proactive Security Starts Here.

Resources

Support

About Trend

Country Headquarters