Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\F5FltDrv] 'ImagePath' = '<DRIVERS>\F5FltDrv.sys'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\BIGIP\KAS00128.1.0.0\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.cab
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\23eda.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\23ed9.mst
- %TEMP%\Cab9.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %TEMP%\Cab1C.tmp
- C:\Config.Msi\23edb.rbs
- %TEMP%\Cab1A.tmp
- %TEMP%\Cab18.tmp
- %TEMP%\Cab16.tmp
- %TEMP%\Cab14.tmp
- %TEMP%\Cab12.tmp
- %TEMP%\Cab10.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\F5_TMP_00216734_00003568\urxhost.cab
- %TEMP%\logterminal.txt
- %WINDIR%\Installer\MSIE.tmp
- %ProgramFiles%\F5 VPN\dpinst\x86\dpinst.exe
- %ProgramFiles%\F5 VPN\dpinst\x64\dpinst.exe
- %ProgramFiles%\F5 VPN\F5_TMP\f5tunsrv.cab
- %ProgramFiles%\F5 VPN\F5_TMP\InstallerControl.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxshost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxhost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\f5InspectionHost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxvpn.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxdialerres.cab
- %ProgramFiles%\F5 VPN\F5_TMP\psapi.cab
- <DRIVERS>\F5FltDrv.sys
- <SYSTEM32>\F5FltSrv.exe
- <SYSTEM32>\F5TrafficSrv.exe
- <SYSTEM32>\F5InstallerService.exe
- %WINDIR%\Installer\23ed8.msi
- %WINDIR%\Installer\MSIC.tmp
- %TEMP%\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\23ed4.msi
- %TEMP%\Kasbank_Certificates_1.0_ENG.log
- %TEMP%\BIGIP\Install.cmd
- %TEMP%\BIGIP\KAS01004.1.0.0\Kasbank_Certificates_1.0_ENG.msi
- %TEMP%\BIGIP\KAS00128.1.0.0\f5fpclients.msi
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\scew_uls.dll
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxvpn.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxshost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxhost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxdialerres.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urvncx.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\ur5250x.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\psapi.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\msrdp.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\InstallerControl.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\f5tunsrv.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\f5InspectionHost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5TrafficSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5InstallerService.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5FltSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5FltDrv.sys
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5TrafficSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5FltSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5FltDrv.sys
- %TEMP%\BIGIP\KAS00128.1.0.0\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.mst
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- <SYSTEM32>\Read_CPD.EXE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- <SYSTEM32>\CA-RunPermFile.vbs
- <SYSTEM32>\SetACL20.exe
- <SYSTEM32>\capicom.dll
- %ProgramFiles%\Certificates_1.0_ENG\Cust_Prod_CA(1).crt
- %ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe
- %ProgramFiles%\Certificates_1.0_ENG\Kas_Pol_Prod_CA(2).cer
- %ProgramFiles%\Certificates_1.0_ENG\KASBANK-Root-CA.cer
- C:\Config.Msi\23ed6.rbs
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\23ed5.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %WINDIR%\Installer\23ed7.msi
- %WINDIR%\Installer\MSI1E.tmp
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\BIGIP\KAS00128.1.0.0\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.cab
- %TEMP%\BIGIP\Install.cmd
- %WINDIR%\Installer\23eda.ipi
- %WINDIR%\Installer\23ed8.msi
- %WINDIR%\Installer\23ed9.mst
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.MAP
- %TEMP%\BIGIP\KAS00128.1.0.0\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.mst
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5FltDrv.sys
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\scew_uls.dll
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxvpn.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxshost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxhost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urxdialerres.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\urvncx.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\ur5250x.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\psapi.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\InstallerControl.cab
- <DRIVERS>\F5FltDrv.sys
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\f5tunsrv.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\f5InspectionHost.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5TrafficSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5InstallerService.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5FltSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5FltDrv.sys
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5TrafficSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\amd64\F5FltSrv.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING.VER
- %TEMP%\F5_TMP_00216734_00003568\urxhost.cab
- %TEMP%\Cab1C.tmp
- %TEMP%\Cab1A.tmp
- %TEMP%\Cab18.tmp
- %TEMP%\Cab16.tmp
- %TEMP%\Cab14.tmp
- %TEMP%\Cab12.tmp
- %TEMP%\Cab10.tmp
- %WINDIR%\Installer\MSIB.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab5.tmp
- %WINDIR%\Installer\23ed5.ipi
- %WINDIR%\Installer\23ed4.msi
- C:\Config.Msi\23ed6.rbs
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI1E.tmp
- %WINDIR%\Installer\MSIE.tmp
- %ProgramFiles%\F5 VPN\dpinst\x86\dpinst.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\F5 VPN\dpinst\x64\dpinst.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\ComDb.Dat
- C:\Config.Msi\23edb.rbs
- <SYSTEM32>\F5InstallerService.exe
- <SYSTEM32>\F5TrafficSrv.exe
- %TEMP%\BIGIP\KAS00128.1.0.0\F5 VPN\F5_TMP\msrdp.cab
- %TEMP%\BIGIP\KAS00128.1.0.0\f5fpclients.msi
- %ProgramFiles%\F5 VPN\F5_TMP\psapi.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxdialerres.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxvpn.cab
- %ProgramFiles%\F5 VPN\F5_TMP\f5InspectionHost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxhost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\urxshost.cab
- %ProgramFiles%\F5 VPN\F5_TMP\InstallerControl.cab
- %ProgramFiles%\F5 VPN\F5_TMP\f5tunsrv.cab
- <SYSTEM32>\F5FltSrv.exe
- %TEMP%\BIGIP\KAS01004.1.0.0\Kasbank_Certificates_1.0_ENG.msi
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'download.windowsupdate.com':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Другое:
Добавляет корневой сертификат
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение:
- '%ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe' -add "%ProgramFiles%\Certificates_1.0_ENG\KASBANK-Root-CA.cer" -c -s -r localMachine ROOT
- '%ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe' -add "%ProgramFiles%\Certificates_1.0_ENG\Kas_Pol_Prod_CA(2).cer" -c -s -r localMachine CA
- '%ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe' -add "%ProgramFiles%\Certificates_1.0_ENG\Cust_Prod_CA(1).crt" -c -s -r localMachine CA
- '%ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe' -del -c -s -r localMachine CA -sha1 607ffcc6fd1b16457cb45f86cae1df876c1d64cb
- '%ProgramFiles%\Certificates_1.0_ENG\CertMgr.Exe' -del -c -s -r currentUser CA -sha1 607ffcc6fd1b16457cb45f86cae1df876c1d64cb
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\BIGIP\Install.cmd" "
- '<SYSTEM32>\msiexec.exe' /I "%TEMP%\BIGIP\KAS01004.1.0.0\Kasbank_Certificates_1.0_ENG.msi" /L*v "%TEMP%\Kasbank_Certificates_1.0_ENG.log" /qb!
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding C7B281D0995C8147DDE98EC933855E00
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\capicom.dll /s
- '<SYSTEM32>\msiexec.exe' /I "%TEMP%\BIGIP\KAS00128.1.0.0\f5fpclients.msi" TRANSFORMS="%TEMP%\BIGIP\KAS00128.1.0.0\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.mst" /L*v "%TEMP%\BIGIP_EdgeClient_70.2013.0724_ENG_v1.0.0.log"...
- '<SYSTEM32>\msiexec.exe' -Embedding 27B738A5D017C24203961AE2C55E15A3
- '<SYSTEM32>\msiexec.exe' -Embedding 85295F37D40FA4F81C31859F9651030D M Global\MSI0000
