Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsv416.tmp\system.dll
- D:\95cec5269a59aadcf3f3112c3251\2052\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\2052\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\2052\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1055\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1055\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1055\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1053\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1053\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1053\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1049\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1049\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\2070\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\2070\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1046\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1046\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1045\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1045\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1045\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1044\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1044\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1044\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1043\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1043\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1043\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1049\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1030\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\2070\eula.rtf
- %TEMP%\hfic4c9.tmp.html
- %TEMP%\kb2600211_20231107_143838921.html
- %TEMP%\setup_20231107_143837585.html
- %TEMP%\hfibf0b.tmp.html
- D:\95cec5269a59aadcf3f3112c3251\$shtdwn$.req
- D:\95cec5269a59aadcf3f3112c3251\graphics\warn.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\stop.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\sysreqnotmet.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\sysreqmet.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\setup.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\save.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate8.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate7.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate6.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate5.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate4.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate3.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate2.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\rotate1.ico
- D:\95cec5269a59aadcf3f3112c3251\graphics\print.ico
- D:\95cec5269a59aadcf3f3112c3251\3082\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\3082\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\3082\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\3076\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\3076\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1042\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1046\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1042\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1042\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1041\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\splashscreen.bmp
- D:\95cec5269a59aadcf3f3112c3251\1029\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1029\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1028\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1028\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1028\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1025\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1025\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1025\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\setuputility.exe
- D:\95cec5269a59aadcf3f3112c3251\ndp40-kb2600211-x86-x64.msp
- D:\95cec5269a59aadcf3f3112c3251\parameterinfo.xml
- D:\95cec5269a59aadcf3f3112c3251\strings.xml
- D:\95cec5269a59aadcf3f3112c3251\1030\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\uiinfo.xml
- D:\95cec5269a59aadcf3f3112c3251\header.bmp
- D:\95cec5269a59aadcf3f3112c3251\watermark.bmp
- D:\95cec5269a59aadcf3f3112c3251\sqmapi.dll
- D:\95cec5269a59aadcf3f3112c3251\setupui.xsd
- D:\95cec5269a59aadcf3f3112c3251\setupui.dll
- D:\95cec5269a59aadcf3f3112c3251\setupengine.dll
- D:\95cec5269a59aadcf3f3112c3251\setup.exe
- D:\95cec5269a59aadcf3f3112c3251\dhtmlheader.html
- %ProgramFiles(x86)%\centrastage\ndp40-kb2600211-x86-x64.exe
- %TEMP%\nsv416.tmp\nsisdl.dll
- %TEMP%\kb2600211_20231107_143838921-microsoft .net framework 4 client profile-msp0.txt
- D:\95cec5269a59aadcf3f3112c3251\3076\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1030\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1031\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1029\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1041\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1041\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1040\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1040\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1040\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1038\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1038\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1038\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1037\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1037\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1037\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1036\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1036\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1036\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1035\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1035\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1035\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1033\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1033\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1033\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1032\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1032\localizeddata.xml
- D:\95cec5269a59aadcf3f3112c3251\1032\setupresources.dll
- D:\95cec5269a59aadcf3f3112c3251\1031\eula.rtf
- D:\95cec5269a59aadcf3f3112c3251\1031\setupresources.dll
- %WINDIR%\installer\ed76a.msp
Удаляет следующие файлы
- %WINDIR%\inf\smsvchost 4.0.0.0\0001\_smsvchostperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0007\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0008\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0009\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\000a\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\000b\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\000c\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\000d\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\000e\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0010\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0011\_smsvchostperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0011\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0013\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0014\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0015\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0019\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\001d\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\001f\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0404\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0416\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0804\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0005\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0006\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0001\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\_smsvchostperfcounters.h
- %WINDIR%\inf\smsvchost 4.0.0.0\0816\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0006\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0007\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0008\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0009\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\000a\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\000b\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\000c\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\000d\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\000e\_smsvchostperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0816\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\0012\_transactionbridgeperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0010\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0013\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0014\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0015\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0019\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\001d\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\001f\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0404\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0416\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0804\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0005\_smsvchostperfcounters.ini
- %WINDIR%\inf\smsvchost 4.0.0.0\0012\_smsvchostperfcounters.ini
- %WINDIR%\inf\msdtc bridge 4.0.0.0\_transactionbridgeperfcounters.h
Перемещает следующие файлы
- %TEMP%\hfibf0b.tmp.html в %TEMP%\setup_20231107_143837585.html
- %TEMP%\setup_20231107_143837585.html в %TEMP%\kb2600211_20231107_143838921.html
Сетевая активность
Подключается к
- 's3######st-1.amazonaws.com':80
TCP
Запросы HTTP GET
- http://s3######st-1.amazonaws.com/scripting.aem.autotask.net/DotNet403/NDP40-KB2600211-x86-x64.exe
UDP
- DNS ASK s3######st-1.amazonaws.com
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\centrastage\ndp40-kb2600211-x86-x64.exe' /q /norestart
- 'D:\95cec5269a59aadcf3f3112c3251\setup.exe' /q /norestart
- '<SYSTEM32>\unlodctr.exe' /m:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.man"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' /m:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelPerformanceCounters.man"' (со скрытым окном)
- '<SYSTEM32>\unlodctr.exe' "ServiceModelEndpoint 4.0.0.0"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelEndpoint 4.0.0.0"' (со скрытым окном)
- '<SYSTEM32>\unlodctr.exe' "ServiceModelOperation 4.0.0.0"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelOperation 4.0.0.0"' (со скрытым окном)
- '<SYSTEM32>\unlodctr.exe' "ServiceModelService 4.0.0.0"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelService 4.0.0.0"' (со скрытым окном)
- '<SYSTEM32>\unlodctr.exe' "SMSvcHost 4.0.0.0"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' "SMSvcHost 4.0.0.0"' (со скрытым окном)
- '<SYSTEM32>\unlodctr.exe' "MSDTC Bridge 4.0.0.0"' (со скрытым окном)
- '%WINDIR%\syswow64\unlodctr.exe' "MSDTC Bridge 4.0.0.0"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\unlodctr.exe' /m:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.man"
- '%WINDIR%\syswow64\unlodctr.exe' /m:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelPerformanceCounters.man"
- '<SYSTEM32>\unlodctr.exe' "ServiceModelEndpoint 4.0.0.0"
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelEndpoint 4.0.0.0"
- '<SYSTEM32>\unlodctr.exe' "ServiceModelOperation 4.0.0.0"
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelOperation 4.0.0.0"
- '<SYSTEM32>\unlodctr.exe' "ServiceModelService 4.0.0.0"
- '%WINDIR%\syswow64\unlodctr.exe' "ServiceModelService 4.0.0.0"
- '<SYSTEM32>\unlodctr.exe' "SMSvcHost 4.0.0.0"
- '%WINDIR%\syswow64\unlodctr.exe' "SMSvcHost 4.0.0.0"
- '<SYSTEM32>\unlodctr.exe' "MSDTC Bridge 4.0.0.0"
- '%WINDIR%\syswow64\unlodctr.exe' "MSDTC Bridge 4.0.0.0"
