Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\DNE] 'ImagePath' = 'system32\DRIVERS\dne64x.sys'
- [<HKLM>\System\CurrentControlSet\Services\CVPNDRVA] 'ImagePath' = '<DRIVERS>\CVPNDRVA.sys'
Создает следующие сервисы
- 'DNE' system32\DRIVERS\dne64x.sys
- 'CVPNDRVA' <DRIVERS>\CVPNDRVA.sys
Изменения в файловой системе
Создает следующие файлы
- C:\temp\vpn\install.cmd
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\status_down_arrow.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\new_profile.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\modify_profile.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\export_certificate_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\export_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\clear_log_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\title_bar.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\connect.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\enable_log.png
- %ProgramFiles(x86)%\cisco systems\vpn client\vpnapi.dll
- %ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.cat
- %CommonProgramFiles%\deterministic networks\dne\dnes64x.exe
- %CommonProgramFiles%\deterministic networks\dne\dnei64x.dll
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\verify_certificate_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\modify_profile_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\notifications.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\disable_log.png
- %CommonProgramFiles%\deterministic networks\common files\dneinst.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\show_certificate_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\import_profile.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\enable_log_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\disable_log_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\unconnected.ico
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\connected.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\connect_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\profile_logo.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\options_log.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\enroll_certificate_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnect.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\notifications_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\password_logo.png
- %CommonProgramFiles%\deterministic networks\dne\dne64x.sys
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_profile.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\arrow_up.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\show_log_pressed.png
- %CommonProgramFiles%\deterministic networks\dne\dne2000.cat
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set72e.tmp
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set933.tmp
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\set33dd.tmp
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\set3517.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\inf\oem2.pnf
- <SYSTEM32>\set6961.tmp
- <DRIVERS>\set6990.tmp
- %WINDIR%\inf\oem0.pnf
- %WINDIR%\inf\oem1.pnf
- %WINDIR%\inf\oem3.pnf
- %WINDIR%\temp\fwtsqmfile00.sqm
- %ProgramFiles(x86)%\cisco systems\vpn client\vpnclient.ini
- %WINDIR%\temp\uddc79e.tmp
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\setdd97.tmp
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set5a6.tmp
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnect_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\cancel.png
- %PROGRAMDATA%\microsoft\windows\start menu\programs\cisco systems vpn client\vpn client.lnk
- %CommonProgramFiles%\deterministic networks\dne\dne2000m.inf
- %CommonProgramFiles%\deterministic networks\dne\dne2000m.cat
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\ra.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[3] msk.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[4] spb.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[5] ekb.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[6] tyumen.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[7] belgorod.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[8] nsk.pcf
- %ProgramFiles(x86)%\cisco systems\vpn client\profiles\[9] yakutsk.pcf
- %WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icon09db8a85.exe
- %WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icond4cbeb74.exe
- %WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icon09db8a851.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\cisco systems vpn client\set mtu.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\vpngui.exe.lnk
- %WINDIR%\temp\dneinst.log
- %CommonProgramFiles%\deterministic networks\dne\dne2000.inf
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\options_log_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\show_log.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\simple_mode_logo.png
- %WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcalla.dll
- %WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcalla1.dll
- %TEMP%\_5fdc06bf_3d3d_4367_8ffb_4fafcb61972d_.tmp
- %WINDIR%\vpninstall.mif
- %WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisedata.ini
- %WINDIR%\temp\dneca.log
- <DRIVERS>\cvpndrva.sys
- %ProgramFiles(x86)%\cisco systems\vpn client\vainst64.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.inf
- %ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.sys
- %ProgramFiles(x86)%\cisco systems\vpn client\cisco_cert_mgr.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\cvpnd.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\ipsecdialer.exe
- nul
- C:\temp\vpn\vpnfix_32.reg
- %WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustcall64.dll
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\setdf0f.tmp
- %ProgramFiles(x86)%\cisco systems\vpn client\ipseclog.exe
- C:\temp\vpn\install_v2.ps1
- C:\temp\vpn\dneupdate.msi
- C:\temp\vpn\dneupdate64.msi
- C:\temp\vpn\vpnclient_setupx32.msi
- C:\temp\vpn\vpnclient_setupx64.msi
- C:\temp\vpn\[1] dc msk (общий).pcf
- C:\temp\vpn\[2] dc hm (общий).pcf
- C:\temp\vpn\install_v2.cmd
- C:\temp\vpn\[3] msk.pcf
- C:\temp\vpn\[5] ekb.pcf
- C:\temp\vpn\[6] tyumen.pcf
- C:\temp\vpn\[7] belgorod.pcf
- C:\temp\vpn\[8] nsk.pcf
- C:\temp\vpn\[9] yakutsk.pcf
- C:\temp\vpn\ra.pcf
- C:\temp\vpn\[4] spb.pcf
- C:\temp\vpn\vpnfix_64.reg
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set41f.tmp
- %ProgramFiles(x86)%\cisco systems\vpn client\ppptool.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\vpngui.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\new_profile_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\logo.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_profile_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\vpn_panel.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\import_certificate_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\import_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnecting.ico
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\cancel_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\import_profile_pressed.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\enroll_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\connected.ico
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\splash_screen.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\show_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\setmtu.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\arrow_down.png
- %ProgramFiles(x86)%\cisco systems\vpn client\vpnclient.exe
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\clear_log.png
- %WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcall.dll
- %ProgramFiles(x86)%\cisco systems\vpn client\qt-mt335.dll
- %ProgramFiles(x86)%\cisco systems\vpn client\accessible\qtwidgets100.dll
- %ProgramFiles(x86)%\cisco systems\vpn client\include\windows_stdint.h
- %ProgramFiles(x86)%\cisco systems\vpn client\include\vpnapi.h
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\vainstaller_fc.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\ppptool_fc.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\qt_jp.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\vpngui_fc.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\autoinstallgui_jp.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\ppptool_jp.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\qt_fc.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\vpngui_jp.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\autoinstallgui_fc.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\languages\vainstaller_jp.qm
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\verify_certificate.png
- %ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_certificate_pressed.png
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\sete077.tmp
Присваивает атрибут 'скрытый' для следующих файлов
- C:\temp\vpn\dneupdate.msi
- C:\temp\vpn\dneupdate64.msi
- C:\temp\vpn\vpnclient_setupx32.msi
- C:\temp\vpn\vpnclient_setupx64.msi
- C:\temp\vpn\vpnfix_32.reg
- C:\temp\vpn\vpnfix_64.reg
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Удаляет следующие файлы
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\dne2000m.cat
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\dne2000m.inf
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne2000.cat
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne2000.inf
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne64x.sys
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dnei64x.dll
- %WINDIR%\temp\uddc79e.tmp
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.cat
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.inf
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.sys
Перемещает следующие системные файлы
- <SYSTEM32>\catroot2\edb00562.log в <SYSTEM32>\catroot2\edbtmp.log
- <SYSTEM32>\catroot2\edb.log в <SYSTEM32>\catroot2\edb00563.log
Перемещает следующие файлы
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set41f.tmp в %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne2000.cat
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set5a6.tmp в %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne2000.inf
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set72e.tmp в %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dne64x.sys
- %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\set933.tmp в %TEMP%\{3187df2e-4077-79b8-ae84-b348f90af548}\dnei64x.dll
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\set33dd.tmp в %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\dne2000m.cat
- %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\set3517.tmp в %TEMP%\{3399ace8-0bb7-324a-b534-8910da70611a}\dne2000m.inf
- <SYSTEM32>\set6961.tmp в <SYSTEM32>\dnei64x.dll
- <DRIVERS>\set6990.tmp в <DRIVERS>\dne64x.sys
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\setdd97.tmp в %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.cat
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\setdf0f.tmp в %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.inf
- %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\sete077.tmp в %TEMP%\{4129ac3a-0129-15bc-d184-eb3e95acd95f}\cvirta64.sys
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass C:\temp\VPN\install_v2.ps1 -win 7 -arch 64 -uni first
- '%WINDIR%\installer\msibe8d.tmp' -cmd NormalizeDneRefCounts -osver 601
- '%WINDIR%\installer\msied74.tmp' -cmd CopyAndBackupFiles -src "C:\temp\VPN\" -dst "%ProgramFiles(x86)%\Cisco Systems\VPN Client\Profiles" -file *.pcf -rb 0
- '%WINDIR%\installer\msiee9e.tmp' -cmd CopyAndBackupFiles -src "C:\temp\VPN\" -dst "%ProgramFiles(x86)%\Cisco Systems\VPN Client\" -file vpnclient.ini -rb 0
- '%CommonProgramFiles%\deterministic networks\common files\dneinst.exe' -Install -InstallPath "%CommonProgramFiles%\Deterministic Networks\DNE"
- '%CommonProgramFiles%\deterministic networks\dne\dnes64x.exe' networks\DNE\dnes64x.exe -c s -l "C:\PROGRA~1\COMMON~1\DETERM~1\DNE\dne2000.inf" -i dni_dne
- '%WINDIR%\installer\msib839.tmp' -cmd SetClientLanguage -lang 1033
- '%CommonProgramFiles%\deterministic networks\common files\dneinst.exe' -AddPlugin CVPNDRVA -Description "Cisco Systems Inc. IPSec Driver" -InstallPath <DRIVERS> -Verbose
- '%ProgramFiles(x86)%\cisco systems\vpn client\vainst64.exe' nopopup i "%ProgramFiles(x86)%\Cisco Systems\VPN Client\Setup\CVirtA64.inf" CS_VirtA
- '%CommonProgramFiles%\deterministic networks\dne\dnes64x.exe' networks\DNE\dnes64x.exe -c s -l "C:\PROGRA~1\COMMON~1\DETERM~1\DNE\dne2000.inf" -i dni_dne' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\temp\VPN\install_v2.cmd" first"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" ver "
- '%WINDIR%\syswow64\findstr.exe' /C:"Microsoft Windows [Version 10"
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
- '%WINDIR%\syswow64\msiexec.exe' /x {5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /x {1FFC4FB9-798E-40ED-B012-DE2D822FFC10} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /i C:\temp\VPN\vpnclient_setupX64.msi /quiet /norestart
