Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{f4220b74-9edd-4ded-bc8b-0342c1e164d8}' = '"%ALLUSERSPROFILE%\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_red...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsbd2a.tmp\system.dll
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1046\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1049\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1049\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1055\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1055\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\2052\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\2052\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\3082\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\3082\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_amd64_20220722130939.log
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.be\vc_redist.x64.exe
- %ALLUSERSPROFILE%\package cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\vc_redist.x64.exe
- %ALLUSERSPROFILE%\package cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\state.rsm
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\windows7_msu_x64
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\vcruntimeminimum_x64
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\vcruntimeadditional_x64
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\cab5046a8ab272bf37297bb7928664c9503
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\cab2c04ddc374bd96eb5c8eb8208f2c7c92
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\1b16883af208e443a00f37f98b0c356f.tmp
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\718bb390b893664dbada8686b2ff6e10.tmp
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\768c0050c405714c9666277fe81d1764.tmp
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\98e934e99da8b64db453fe7c6438282c.tmp
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1046\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\4854037d-e0af-4d3d-9d05-2dc57acf0908\source.cab
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1045\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1042\license.rtf
- %TEMP%\nsbd2a.tmp\modern-header.bmp
- %TEMP%\nsbd2a.tmp\modern-wizard.bmp
- %TEMP%\nsbd2a.tmp\inetc.dll
- %ProgramFiles%\wildix\wiservice\vcredist_x64.exe
- %WINDIR%\temp\{60e63b59-45bd-47a8-97dd-583379af582e}\.cr\vcredist_x64.exe
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\wixstdba.dll
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\thm.xml
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\logo.png
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1028\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1028\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1029\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1029\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1031\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1031\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1036\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1036\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1040\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1040\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1041\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1041\license.rtf
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1042\thm.wxl
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.ba\1045\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\4854037d-e0af-4d3d-9d05-2dc57acf0908\package.cab
Удаляет следующие файлы
- %WINDIR%\softwaredistribution\scanfile\4854037d-e0af-4d3d-9d05-2dc57acf0908\source.cab
Перемещает следующие файлы
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\windows7_msu_x64 в %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64
- %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64 в %ALLUSERSPROFILE%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\vcruntimeminimum_x64 в %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64
- %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64 в %ALLUSERSPROFILE%\package cache\{f7cac7df-3524-4c2d-a7db-e16140a3d5e6}v14.21.27702\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\cab5046a8ab272bf37297bb7928664c9503 в %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503
- %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503 в %ALLUSERSPROFILE%\package cache\{f7cac7df-3524-4c2d-a7db-e16140a3d5e6}v14.21.27702\packages\vcruntimeminimum_amd64\cab1.cab
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\vcruntimeadditional_x64 в %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64
- %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64 в %ALLUSERSPROFILE%\package cache\{12578975-c765-4bdf-8ddc-3284bc0e855f}v14.21.27702\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi
- %WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\cab2c04ddc374bd96eb5c8eb8208f2c7c92 в %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92
- %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92 в %ALLUSERSPROFILE%\package cache\{12578975-c765-4bdf-8ddc-3284bc0e855f}v14.21.27702\packages\vcruntimeadditional_amd64\cab1.cab
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\1b16883af208e443a00f37f98b0c356f.tmp в C:\1519eaf9db4a10f15185f0432c33\wsusscan.cab
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\718bb390b893664dbada8686b2ff6e10.tmp в C:\1519eaf9db4a10f15185f0432c33\windows6.1-kb2999226-x64.cab
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\768c0050c405714c9666277fe81d1764.tmp в C:\1519eaf9db4a10f15185f0432c33\windows6.1-kb2999226-x64-pkgproperties.txt
- C:\1519eaf9db4a10f15185f0432c33\$dpx$.tmp\98e934e99da8b64db453fe7c6438282c.tmp в C:\1519eaf9db4a10f15185f0432c33\windows6.1-kb2999226-x64.xml
Сетевая активность
Подключается к
- 'fi#####es.wildix.com':80
TCP
Запросы HTTP GET
- http://fi#####es.wildix.com/app/integrations/vc_redist_2019.x64.exe
UDP
- DNS ASK fi#####es.wildix.com
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\wildix\wiservice\vcredist_x64.exe' /install /quiet /norestart
- '%WINDIR%\temp\{60e63b59-45bd-47a8-97dd-583379af582e}\.cr\vcredist_x64.exe' -burn.clean.room="%ProgramFiles%\Wildix\WIService\vcredist_x64.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{5FC74CAE-7373-4014-84B5-7B495580F84F} {F0AB0099-BF3A-43DE-A38A-DED3CCA5B73F} 1956
- '%WINDIR%\temp\{e5bf904b-6fd8-4d72-8551-7ee95a13014c}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{5FC74CAE-7373-4014-84B5-7B495580F84F} {F0AB0099-BF3A-43DE-A38A-DED3CCA5B73F} 1956' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\wusa.exe' "%ALLUSERSPROFILE%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
