Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}' = '"%PROGRAMDATA%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{01db25f3-1b76-4d97-88c8-1c90634d88fb}' = '"%PROGRAMDATA%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{615bc16d-60f5-482e-91b3-b51d8130963b}' = '"%PROGRAMDATA%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}' = '"%PROGRAMDATA%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x...
- <SYSTEM32>\tasks\google update
- [<HKLM>\System\CurrentControlSet\Services\SrvUpdater] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SrvUpdater] 'ImagePath' = '%ProgramFiles(x86)%\SoftwareUpdater\Upd4terSrv.exe'
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe
- %TEMP%\updinstaller.exe
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.wxl
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\logo.png
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\license.rtf
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20190930004551.log
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\wixstdba.dll
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\wixstdba.dll
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.wxl
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20190930004558.log
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\wixstdba.dll
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.wxl
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\logo.png
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\license.rtf
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\logo.png
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\license.rtf
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.be\vcredist_x86.exe
- %TEMP%\dd_vcredist_x86_20190930004544.log
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\nso80db.tmp\system.dll
- %TEMP%\nso80db.tmp\nsurl.dll
- %ProgramFiles(x86)%\softwareupdater\config.xml
- %ProgramFiles(x86)%\softwareupdater\appsupd4ter.exe.config
- %ProgramFiles(x86)%\softwareupdater\interop.shell32.dll
- %ProgramFiles(x86)%\softwareupdater\translations.xml
- %TEMP%\update.zip
- %TEMP%\nso80db.tmp\nsisunz.dll
- %TEMP%\nso80db.tmp\nsexec.dll
- %ProgramFiles(x86)%\softwareupdater\appsupd4ter.exe
- %TEMP%\upr.zip
- %WINDIR%\upr.exe
- %TEMP%\vcredist2012.exe
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\license.rtf
- %ProgramFiles(x86)%\softwareupdater\upd4tersrv.exe
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20190930004605.log
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\nso80db.tmp\nsisunz.dll
- %TEMP%\nso80db.tmp\nsexec.dll
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.be\vcredist_x86.exe
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\license.rtf
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\wixstdba.dll
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.wxl
- %TEMP%\nso80db.tmp\nsurl.dll
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\logo.png
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\wixstdba.dll
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.wxl
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\logo.png
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\license.rtf
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\wixstdba.dll
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.wxl
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\logo.png
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\license.rtf
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\license.rtf
- %TEMP%\nso80db.tmp\system.dll
- %PROGRAMDATA%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe в %TEMP%\del5e3a.tmp
- %PROGRAMDATA%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe в %TEMP%\del604d.tmp
- %PROGRAMDATA%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe в %TEMP%\del6232.tmp
- http://up#.#pd4ter.com/update/version
- http://cd##.upsa1a.com/tgtudp.exe
- http://cd##.upsa1a.com/tdtjpd.exe
- http://up#.#pd4ter.com/software_stats/?ac########################################################################################################################################################...
- http://up#.#pd4ter.com/installer_stats/?ac#######################################################################################################################################################...
- http://up#.#pd4ter.com/update/update.zip
- http://up#.#pd4ter.com/update/upr.zip
- http://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x86.exe
- DNS ASK up#.#pd4ter.com
- DNS ASK cd##.upsa1a.com
- DNS ASK download.microsoft.com
- ClassName: '' WindowName: ''
- '%TEMP%\updinstaller.exe' /partner=UPDATER /prot=1
- '%TEMP%\vcredist2012.exe' /quiet -burn.unelevated BurnPipe.{D63391C5-5325-403C-A6DD-3FAE2C00EDC6} {977D197F-29AE-4C64-B33F-358F9A5C6957} 764
- '%TEMP%\vcredist2012.exe' /quiet
- '%ProgramFiles(x86)%\softwareupdater\upd4tersrv.exe'
- '%WINDIR%\syswow64\sc.exe' start SrvUpdater' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' create SrvUpdater binpath= "%ProgramFiles(x86)%\SoftwareUpdater\Upd4terSrv.exe" start= auto' (со скрытым окном)
- '%TEMP%\vcredist2012.exe' /quiet' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONSTART /DELAY 0030:00 /TR "%WINDIR%\upr.exe" /tn "Google Update" /rl HIGHEST' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "Google Update" /F' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater' (со скрытым окном)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_ComputerSystem Get Model, Manufacturer /FORMAT:textvaluelist.xsl' (со скрытым окном)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_BIOS Get Version, SerialNumber /FORMAT:textvaluelist.xsl' (со скрытым окном)
- '%TEMP%\updinstaller.exe' /partner=UPDATER /prot=1' (со скрытым окном)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct Get displayName /FORMAT:textvaluelist.xsl' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "sc query SrvUpdater | FIND "RUNNING" "' (со скрытым окном)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_BIOS Get Version, SerialNumber /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_ComputerSystem Get Model, Manufacturer /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "Google Update" /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct Get displayName /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONSTART /DELAY 0030:00 /TR "%WINDIR%\upr.exe" /tn "Google Update" /rl HIGHEST
- '%WINDIR%\syswow64\sc.exe' create SrvUpdater binpath= "%ProgramFiles(x86)%\SoftwareUpdater\Upd4terSrv.exe" start= auto
- '%WINDIR%\syswow64\sc.exe' start SrvUpdater
- '%WINDIR%\syswow64\cmd.exe' /c "sc query SrvUpdater | FIND "RUNNING" "
- '%WINDIR%\syswow64\sc.exe' query SrvUpdater
- '%WINDIR%\syswow64\find.exe' "RUNNING"