Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Cisco AnyConnect Secure Mobility Agent for Windows' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpn...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'ImagePath' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"'
- [<HKLM>\System\CurrentControlSet\Services\acsock] 'ImagePath' = 'system32\DRIVERS\acsock64.sys'
- [<HKLM>\System\CurrentControlSet\Services\vpnva] 'ImagePath' = 'system32\DRIVERS\vpnva64.sys'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\profiles\vpn\sslvpn-profile-everys.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_3.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_2.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_1.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\neutral.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\error.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\attention.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_trusted.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\opensource.html
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\uninstall.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down-solid.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gradient.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about.png
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\vpnmanifestclient.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_transition.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_neutral.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_good.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_error.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_attention.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_connected.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar.png
- %WINDIR%\temp\udd6c4.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help.png
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc4bb.tmp
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc3ef.tmp
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc2e4.tmp
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xml
- %WINDIR%\temp\udd9ada.tmp
- <DRIVERS>\set96c3.tmp
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\profile\sslvpn-profile-everys.xml
- %PROGRAMDATA%\microsoft\windows\start menu\cisco anyconnect secure mobility client.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs_hover.png
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\eula.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\app_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo_alt.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acfeedback.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommoncrypt.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscocrypto.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommon.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\zlib1.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe
- %WINDIR%\syswow64\vpnevents.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe
- %TEMP%\rarsfx0\setup.hta
- %TEMP%\rarsfx0\setup.exe
- %TEMP%\rarsfx0\install.bat
- %TEMP%\rarsfx0\eula.html
- %TEMP%\rarsfx0\certmgr.exe
- %TEMP%\rarsfx0\ca.cer
- %TEMP%\rarsfx0\autorun.inf
- %TEMP%\rarsfx0\anyconnect-win-3.1.01065-pre-deploy-k9.msi
- %TEMP%\rarsfx0\anyconnect-dart-win-3.1.01065-k9.msi
- %TEMP%\rarsfx0\setup\update.txt
- %TEMP%\rarsfx0\setup\gui.ico
- %TEMP%\rarsfx0\setup\eula_dialog.html
- %TEMP%\rarsfx0\setup\cues_bg.jpg
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscossl.dll
- %PROGRAMDATA%\microsoft\event viewer\views\cisco\ciscoanyconnect.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\ac_sock_fltr_api.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\cues_bg.jpg
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnipsec.dll
- %WINDIR%\syswow64\vpncategories.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagentutilities.dll
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gui.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnapi.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncli.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64.inf
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\update.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpndownloader.exe
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\profile\anyconnectprofile.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.sys
- %PROGRAMDATA%\cisco\cisco anyconnect secure mobility client\vpnmanifest.dat
Присваивает атрибут 'скрытый' для следующих файлов
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Удаляет следующие файлы
- %WINDIR%\temp\udd9ada.tmp
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.cat
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.inf
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.sys
- %WINDIR%\temp\udd6c4.tmp
- %TEMP%\rarsfx0\anyconnect-dart-win-3.1.01065-k9.msi
- %TEMP%\rarsfx0\anyconnect-win-3.1.01065-pre-deploy-k9.msi
- %TEMP%\rarsfx0\autorun.inf
- %TEMP%\rarsfx0\ca.cer
- %TEMP%\rarsfx0\certmgr.exe
- %TEMP%\rarsfx0\eula.html
- %TEMP%\rarsfx0\install.bat
- %TEMP%\rarsfx0\setup.exe
- %TEMP%\rarsfx0\setup.hta
- %TEMP%\rarsfx0\profiles\vpn\sslvpn-profile-everys.xml
Перемещает следующие файлы
- <DRIVERS>\set96c3.tmp в <DRIVERS>\acsock64.sys
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc2e4.tmp в %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.cat
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc3ef.tmp в %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.inf
- %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\setc4bb.tmp в %TEMP%\{1864add5-da06-7280-4593-2f27307f5b6c}\vpnva64.sys
Сетевая активность
UDP
- DNS ASK vp#.###on.everys.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%PROGRAMDATA%\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acl "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\" -r
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%PROGRAMDATA%\Cisco\Cisco AnyConnect VPN Client\update.txt" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect VPN Client\vpndownloader.exe" "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva64.inf" VPNVA
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe'
- '%TEMP%\rarsfx0\certmgr.exe' -add -c CA.cer -s -r localMachine root
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acpolgen bd=false fm=false rpc=false rtp=false rwl=false sct=false
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%TEMP%\RarSFX0\Profiles\vpn\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%TEMP%\RarSFX0\Profiles\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%PROGRAMDATA%\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%PROGRAMDATA%\\Cisco\Cisco AnyConnect VPN Client\Script\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%PROGRAMDATA%\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "%PROGRAMDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "<LS_APPDATA>\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "<LS_APPDATA>\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' kdf -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsock
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\install.bat" "
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\RarSFX0\anyconnect-win-3.1.01065-pre-deploy-k9.msi" /quiet
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\RarSFX0\anyconnect-dart-win-3.1.01065-k9.msi" /quiet
