Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\d7tr0ojr0df0
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\nfxc4gd.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-xl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\et-ee\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\eu-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fi-fi\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-be\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-ca\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-ch\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-fr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-xf\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\gl-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-mx\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-us\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\he-il\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\is-is\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\it-it\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ja-jp\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ko-kr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lb-lu\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lt-lt\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lv-lv\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ms-my\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nb-no\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nl-be\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\hr-hr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\hu-hu\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-co\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-cl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\metadata.json
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ar-sa\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\bg-bg\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ca-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ca-es-valencia\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\cs-cz\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\da-dk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-at\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-ch\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-de\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\el-gr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content.cab
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-au\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-gb\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-hk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-id\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ie\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-in\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-my\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-nz\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ph\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-us\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-za\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-ar\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ca\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nl-nl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nn-no\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
Перемещает следующие файлы
- %ProgramFiles%\unp\logs\updatenotificationpipeline.001.etl в %ProgramFiles%\unp\logs\updatenotificationpipeline.002.etl
Подменяет следующие исполняемые файлы
- <Полный путь к файлу>
Подменяет следующие файлы
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
Самоперемещается
- из <Полный путь к файлу> в <Текущая директория>\old_<Имя файла>.exe
Сетевая активность
TCP
Запросы HTTP GET
- http://w.google.com/
- http://cu##t.org/oxgBR
- http://q.#s/EVnYC
- http://ap###sal.net/-20ODHZ/EVnYC?rn#########################
- http://ap###sal.net/suspended?a=############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?80##############
UDP
- DNS ASK w.google.com
- DNS ASK cu##t.org
- DNS ASK q.#s
- DNS ASK ap###sal.net
Другое
Ищет следующие окна
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\usoclient.exe' StartScan
- '<SYSTEM32>\apphostregistrationverifier.exe'
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /RL HIGHEST /SC ONLOGON /TR "<Полный путь к файлу>" /TN d7tr0ojR0df0 /F
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Query /XML /TN d7tr0ojR0df0 > <Текущая директория>\nFXC4Gd.xml
- '%WINDIR%\syswow64\schtasks.exe' /Query /XML /TN d7tr0ojR0df0
