Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] 'Logon' = 'SCardStartCertProp'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eTMonitor' = '%CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\PKIMonitor.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] 'DLLName' = 'wlnotify.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\RegistereTokenVirtual.Document\shell\open\command] '' = '"%CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\RegistereTokenVirtual.exe" "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SCardSvr] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AKSIFDH] 'ImagePath' = 'system32\DRIVERS\aksifdh.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\eTSCFLT] 'ImagePath' = 'system32\DRIVERS\eTSCFLT.sys'
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\etPropBasic.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\etPropBasic.rcc
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\PKIMonitor.rcc
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\PhysicalDevices.dll
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.inf
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.sys
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.cat
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.cat
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\PKIMonitor.exe
- <SYSTEM32>\Setup\Aladdin\eToken\etscflt.cat
- <SYSTEM32>\Setup\Aladdin\eToken\eTSCFLT.sys
- <DRIVERS>\eTSCFLT.sys
- %WINDIR%\Installer\MSIC.tmp
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\StoreSync.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\SingleLogon.dll
- <SYSTEM32>\Setup\Aladdin\eToken\eTSCFLT.inf
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\RegistereTokenVirtual.exe
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\StoreSync_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\PhysicalDevices_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\etProps.exe
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\eTokenProperties.chm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\PKIMonitor_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\eTokenUI_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\RegistereTokenVirtual_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\etPropBasic_En.qm
- <SYSTEM32>\eTCAPI.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\NG-FLASH Partition\CDFS.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\NG-FLASH Partition\NGFlashPartition_README.pdf
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.inf
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.sys
- <SYSTEM32>\eTFS.dll
- <SYSTEM32>\eTOKCSP.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\NG-FLASH Partition\NgFlashPartition.exe
- <SYSTEM32>\etVerifier.dll
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <DRIVERS>\SET1B.tmp
- <SYSTEM32>\ReinstallBackups\0000\DriverFiles\aksifdh.sys
- <DRIVERS>\SET1D.tmp
- %WINDIR%\Temp\OLD1C.tmp
- <SYSTEM32>\ReinstallBackups\0000\DriverFiles\aksifdh.inf
- <DRIVERS>\SET1A.tmp
- <SYSTEM32>\ReinstallBackups\0000\DriverFiles\aksifdh.PNF
- <SYSTEM32>\ReinstallBackups\0000\DriverFiles\aksifdh.cat
- %ALLUSERSPROFILE%\Start Menu\Programs\eToken\eToken Properties.lnk
- %WINDIR%\Installer\MSI1F.tmp
- %WINDIR%\Installer\MSI1E.tmp
- %TEMP%\MSI2c47f.LOG
- %WINDIR%\Installer\MSI20.tmp
- %WINDIR%\Installer\{2146B7E6-FC1C-4230-9952-E9CA2260AA08}\IconTmpl1.4E925A60_ECBB_48B2_A8A2_CB68847266E1.exe
- %WINDIR%\Installer\1eff3.msi
- %WINDIR%\Installer\{2146B7E6-FC1C-4230-9952-E9CA2260AA08}\IconTmpl.23A84520_76E7_41E2_A9CC_A14FB7416C8B.exe
- %WINDIR%\Installer\{2146B7E6-FC1C-4230-9952-E9CA2260AA08}\IconTmpl.4E925A60_ECBB_48B2_A8A2_CB68847266E1.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <DRIVERS>\SET11.tmp
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\oem4.inf
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %WINDIR%\Temp\OLD10.tmp
- %WINDIR%\LastGood\TMPF.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem5.CAT
- %WINDIR%\Temp\OLD17.tmp
- %WINDIR%\LastGood\TMP16.tmp
- %WINDIR%\Temp\OLD19.tmp
- <DRIVERS>\SET18.tmp
- %WINDIR%\inf\oem5.PNF
- %WINDIR%\inf\oem5.inf
- <DRIVERS>\aksup.sys
- <DRIVERS>\aksifdh.sys
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\commonUI_En.qm
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseData.ini
- %WINDIR%\Installer\MSI8.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseCustomCall.dll
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseCustomCalla2.CEB85044_2EEF_484A_8907_2EAF870F92ED.dll
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseCustomCall.CEB85044_2EEF_484A_8907_2EAF870F92ED.dll
- %TEMP%\RarSFX0\WindowsInstaller-KB893803-v2-x86.exe
- %TEMP%\RarSFX0\PKIClient-x32-4.55.81.msi
- %WINDIR%\Installer\1efe9.msi
- %TEMP%\RarSFX0\install.vbs
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseCustomCalla1.CEB85044_2EEF_484A_8907_2EAF870F92ED.dll
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\eTCoreInst.log
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\2146B7E6FC1C42309952E9CA2260AA08.TMP\WiseCustomCalla.CEB85044_2EEF_484A_8907_2EAF870F92ED.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\1efeb.ipi
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\plc4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\nspr4.dll
- <SYSTEM32>\eTPKCS11.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\plds4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\libplds4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\smime3.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\MZcertutil.exe
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\softokn3.dll
- <SYSTEM32>\eTCoreReg.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\QtXml4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\plugins\imageformats\qjpeg1.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\Languages\etProps_En.qm
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\qt.conf
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\eTokenUI.dll
- <SYSTEM32>\eTSAPI.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\QtGui4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\x32\QtCore4.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI9.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %WINDIR%\Installer\MSIA.tmp
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\libplc4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\libnspr4.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\modutil.exe
- %CommonProgramFiles%\Aladdin Shared\eToken\PKIClient\modutil\nss3.dll
- %CommonProgramFiles%\Aladdin Shared\eToken\App-RTE.ico
- C:\Config.Msi\1efec.rbs
- <SYSTEM32>\eTCoreInst.dll
- <SYSTEM32>\eToken.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\Config.Msi\1eff2.rbf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem5.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- C:\Config.Msi\1eff1.rbf
- C:\Config.Msi\1efee.rbf
- C:\Config.Msi\1efed.rbf
- C:\Config.Msi\1eff0.rbf
- C:\Config.Msi\1efef.rbf
Удаляет следующие файлы:
- <DRIVERS>\aksifdh.sys
- %WINDIR%\Temp\OLD17.tmp
- <DRIVERS>\eTSCFLT.sys
- %WINDIR%\Temp\OLD10.tmp
- %WINDIR%\Temp\OLD19.tmp
- %WINDIR%\Installer\MSI1E.tmp
- %WINDIR%\Installer\MSI1F.tmp
- %WINDIR%\Temp\OLD1C.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI7.tmp
Перемещает следующие файлы:
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.cat в C:\Config.Msi\1eff2.rbf
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.cat в C:\Config.Msi\1eff1.rbf
- %WINDIR%\LastGood\TMP16.tmp в %WINDIR%\LastGood\system32\DRIVERS\aksifdh.sys
- %WINDIR%\LastGood\TMPF.tmp в %WINDIR%\LastGood\system32\DRIVERS\eTSCFLT.sys
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.sys в C:\Config.Msi\1efee.rbf
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.sys в C:\Config.Msi\1efed.rbf
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.inf в C:\Config.Msi\1eff0.rbf
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.inf в C:\Config.Msi\1efef.rbf
Подменяет следующие файлы:
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.cat
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.cat
- <DRIVERS>\aksifdh.sys
- <DRIVERS>\eTSCFLT.sys
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.sys
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.sys
- <SYSTEM32>\Setup\Aladdin\eToken\aksup.inf
- <SYSTEM32>\Setup\Aladdin\eToken\aksifdh.inf
Сетевая активность:
Подключается к:
- 'csc3-2004-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://CSC3-2004-crl.verisign.com/CSC3-2004.crl via csc3-2004-crl.verisign.com
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK csc3-2004-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\install.vbs"
Запускает на исполнение:
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\msiexec.exe' /Y "<SYSTEM32>\etVerifier.dll"
- '<SYSTEM32>\scardsvr.exe'
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i PKIClient-x32-4.55.81.msi PROP_ADVANCED_VIEW=0 /qb /norestart
- '<SYSTEM32>\msiexec.exe' -Embedding 03E1A3C127B7E9A7ADACFBD0DC181BC7 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' -Embedding 5127CFF8BAD0F5B22715124D039FAD2E
