Trojan.Siggen11.57611

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Check Point VPN' = '"%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\TrGui.exe"'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\vna_ap] 'ImagePath' = 'system32\DRIVERS\vnaap.sys'
[<HKLM>\System\CurrentControlSet\Services\wscsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\TracSrvWrapper] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\TracSrvWrapper] 'ImagePath' = '"%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\TracSrvWrapper.exe"'

Создает следующие сервисы

'vna_ap' system32\DRIVERS\vnaap.sys
'TracSrvWrapper' "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\TracSrvWrapper.exe"
'TracSrvWrapper' %ProgramFiles(x86)%\CheckPoint\Endpoint Connect\TracSrvWrapper.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop PcaSvc
'%WINDIR%\syswow64\taskkill.exe' /f /im google*
'%WINDIR%\syswow64\taskkill.exe' /f /im chrome*
'%WINDIR%\syswow64\taskkill.exe' /f /im bp*

Изменения в файловой системе

Создает следующие файлы

%TEMP%\2928um7b.cmd
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbarred.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\tcpip.def
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.config
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.ddf
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.defaults
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\traccapi.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\tracconnected.wav
%ProgramFiles(x86)%\checkpoint\endpoint connect\traccpinfo.cmd
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\tracfailed.wav
%ProgramFiles(x86)%\checkpoint\endpoint connect\tracsrvwrapper.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\trapi.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\trgui.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\triangle.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\trsaa.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\trscvstub.dll
%WINDIR%\winsxs\installtemp\20210106182822328.0\atl80.dll
%WINDIR%\winsxs\installtemp\20210106182822359.0\atl90.dll
%WINDIR%\winsxs\installtemp\20210106182822375.0\atl90.dll
%WINDIR%\winsxs\installtemp\20210106182822359.0\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat
%WINDIR%\winsxs\installtemp\20210106182822375.0\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.cat
%WINDIR%\winsxs\installtemp\20210106182822391.0\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.cat
%WINDIR%\winsxs\installtemp\20210106182822406.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat
%WINDIR%\winsxs\installtemp\20210106182822406.1\9.0.30729.1.cat
%WINDIR%\winsxs\installtemp\20210106182822422.0\9.0.30729.1.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbarorange.png
%WINDIR%\winsxs\installtemp\20210106182822422.1\9.0.30729.1.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbargreen.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-ok.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiendpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvplugins-32.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvplugins-64.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvprod_lang_pack.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvproxy-32.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvproxy-64.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sdl.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securityalerticon.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securityinfoicon.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbackground.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbutton.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbuttonpressed.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarlinkbackground.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\site.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\soft.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-error.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-inprogress.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-notrunning.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-warning.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_coinstall.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\helpdesk.log
%WINDIR%\winsxs\installtemp\20210106182822437.1\8.0.50727.42.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna.sys
%WINDIR%\syswow64\zonelabs\vsconfig.xml
%WINDIR%\syswow64\vsdata.dll
%WINDIR%\syswow64\zonelabs\vsdatant.cat
%WINDIR%\syswow64\zonelabs\vsdatant.inf
%WINDIR%\syswow64\zonelabs\vsdatant.sys
%WINDIR%\syswow64\zonelabs\vsdrinst.exe
%WINDIR%\syswow64\vsinit.dll
%WINDIR%\syswow64\vsutil.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\welcome.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\windowssecuritymonitor.dll
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_atl80.dll.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_catalog.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_manifest.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\installer\{7e80ca87-c7ae-4789-8755-df30b96bb8fe}\icon.ico
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\check point\check point endpoint security vpn.lnk
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set6ed8.tmp
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set6fd3.tmp
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set70ae.tmp
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set71a9.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\pireg.exe
%WINDIR%\installer\wix{7e80ca87-c7ae-4789-8755-df30b96bb8fe}.schedserviceconfig.rmi
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac_startup.log
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.log
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiendpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_install64.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\ver.ini
%WINDIR%\winsxs\installtemp\20210106182822328.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat
%WINDIR%\winsxs\installtemp\20210106182822437.2\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat
%WINDIR%\winsxs\installtemp\20210106182822359.0\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.manifest
%WINDIR%\winsxs\installtemp\20210106182822375.0\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.manifest
%WINDIR%\winsxs\installtemp\20210106182822391.0\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest
%WINDIR%\winsxs\installtemp\20210106182822406.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.0\8.0.50727.762.policy
%WINDIR%\winsxs\installtemp\20210106182822437.1\8.0.50727.42.policy
%WINDIR%\winsxs\installtemp\20210106182822328.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.2\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcm80.dll
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcm90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcm90.dll
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcp80.dll
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcp90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcp90.dll
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcr80.dll
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcr90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcr90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.1\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822422.0\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822422.1\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822422.2\9.0.30729.1.policy
%ProgramFiles(x86)%\checkpoint\endpoint connect\uninstallsecureclient.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\update_config_tool.exe
%WINDIR%\winsxs\installtemp\20210106182822422.2\9.0.30729.1.cat
%WINDIR%\winsxs\installtemp\20210106182822437.0\8.0.50727.762.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiconnlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\error.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\cp_right.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpbcrypt.dll
%WINDIR%\syswow64\cpepc_plap.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpmsi_tool.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpopenssl.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpprng.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\datastruct.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\disconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\dtplat.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\encryption.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointdisconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-disabled.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-error.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-limitaddition.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-ok.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-warning.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\epc.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\epcgina.dll
%WINDIR%\syswow64\epcginashim.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\cp_middle.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\connecting.gif
%WINDIR%\syswow64\zonelabs\config.xml
%LOCALAPPDATA%\qb10a784.05\bmail.exe
%LOCALAPPDATA%\qb10a784.05\bp.exe
%LOCALAPPDATA%\qb10a784.05\icono.ico
%LOCALAPPDATA%\qb10a784.05\inicio.cmd
%LOCALAPPDATA%\qb10a784.05\msend.exe
%LOCALAPPDATA%\qb10a784.05\sq.exe
%LOCALAPPDATA%\qb10a784.05\vpn8041.msi
%WINDIR%\bp.exe
%WINDIR%\bmail.exe
%WINDIR%\msend.exe
C:\temp\vpn.log
%WINDIR%\temp\trac_install.log
%TEMP%\2\trac.config
%TEMP%\2\pireg.exe
%TEMP%\internet logs\installer.log
%TEMP%\{7e80ca87-c7ae-4789-8755-df30b96bb8fe}\disconnectedpolicy.xml
%ProgramFiles(x86)%\checkpoint\endpoint connect\adminmode.bat
%ProgramFiles(x86)%\checkpoint\endpoint connect\antivirusmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\apollo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\browsermonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\browserscv.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\certenrollproxy.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\certificate.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\cli_help.txt
%ProgramFiles(x86)%\checkpoint\endpoint connect\collect.bat
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\connected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-compliance.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scuiapi.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\erroricon.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\msvcp60.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\netvna.inf
%ProgramFiles(x86)%\checkpoint\endpoint connect\netvna.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\new_extender.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\newlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\openmail.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\os.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\osmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\osscv.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\packetmon.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\pinpad.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\processmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\progress.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\progressremain.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\proxy.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\proxystub.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\imageformats\qgif4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\qtcore4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\qtgui4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\reauthentication.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\regmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\runas.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\saa.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sad.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scriptrun.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-vpn.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapi.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-fw.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modulebarhighlighted.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\filehash_dyn.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\finish.png
%WINDIR%\syswow64\firewallmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\footer.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\fwcpp.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\fwmonitor.def
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\globe.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\groupmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\happy.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\header.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\help.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\hotfixmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\hwmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\info.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\keyfob.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\langpack1.xml
%ProgramFiles(x86)%\checkpoint\endpoint connect\logonisreg.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\logs.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modulebar.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\error.gif
%WINDIR%\internet logs\tvdebug.log

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\2928um7b.cmd
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Удаляет следующие файлы

%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\netvna.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\osmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\os.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\openmail.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\newlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\new_extender.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\netvna.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\netvna.inf
%ProgramFiles(x86)%\checkpoint\endpoint connect\msvcp60.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-vpn.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-fw.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modulebarhighlighted.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\keyfob.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modulebar.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\mobile\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\logs.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\logonisreg.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\langpack1.xml
%ProgramFiles(x86)%\checkpoint\endpoint connect\osscv.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\modules-compliance.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\packetmon.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sad.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvprod_lang_pack.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvplugins-64.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvplugins-32.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiendpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiendpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapiconnlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\scuiapi.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scuiapi.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\scriptrun.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\saa.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\processmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\runas.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\regmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\reauthentication.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\qtgui4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\qtcore4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\imageformats\qgif4.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\proxystub.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\proxy.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\progressremain.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\progress.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\pinpad.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\info.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\hwmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\hotfixmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\encryption.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\dtplat.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\disconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\datastruct.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpprng.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpopenssl.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpmsi_tool.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\cpbcrypt.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-disabled.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointdisconnected.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\cp_right.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\connected.png
%WINDIR%\syswow64\zonelabs\config.xml
%ProgramFiles(x86)%\checkpoint\endpoint connect\collect.bat
%ProgramFiles(x86)%\checkpoint\endpoint connect\cli_help.txt
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\certificate.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\certenrollproxy.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\browserscv.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\browsermonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\apollo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\cp_middle.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\connecting.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-error.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-limitaddition.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-ok.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\header.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\happy.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\groupmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\globe.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\fwmonitor.def
%ProgramFiles(x86)%\checkpoint\endpoint connect\fwcpp.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\footer.png
%WINDIR%\syswow64\firewallmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\finish.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\filehash_dyn.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\help.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\erroricon.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\error.gif
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\endpointsecurity\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\epcgina.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\epc.ini
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\enterprisechecks-warning.bmp
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\error.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvproxy-32.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\antivirusmonitor.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\scvproxy-64.reg
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securityalerticon.png
%WINDIR%\winsxs\installtemp\20210106182822391.0\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcm90.dll
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcp90.dll
%WINDIR%\winsxs\installtemp\20210106182822391.0\msvcr90.dll
%WINDIR%\winsxs\installtemp\20210106182822422.1\9.0.30729.1.cat
%WINDIR%\winsxs\installtemp\20210106182822422.1\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822375.0\atl90.dll
%WINDIR%\winsxs\installtemp\20210106182822375.0\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.cat
%WINDIR%\winsxs\installtemp\20210106182822375.0\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.manifest
%WINDIR%\winsxs\installtemp\20210106182822422.0\9.0.30729.1.cat
%WINDIR%\winsxs\installtemp\20210106182822359.0\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\windowssecuritymonitor.dll
%WINDIR%\winsxs\installtemp\20210106182822359.0\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.manifest
%WINDIR%\winsxs\installtemp\20210106182822359.0\atl90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.1\9.0.30729.1.cat
%WINDIR%\winsxs\installtemp\20210106182822406.1\9.0.30729.1.policy
%WINDIR%\installer\wix{7e80ca87-c7ae-4789-8755-df30b96bb8fe}.schedserviceconfig.rmi
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\check point\check point endpoint security vpn.lnk
%WINDIR%\installer\{7e80ca87-c7ae-4789-8755-df30b96bb8fe}\icon.ico
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_manifest.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_catalog.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\installer\$patchcache$\managed\78ac08e7ea7c98747855fd039bb68bef\98.60.37\ul_atl80.dll.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
%WINDIR%\winsxs\installtemp\20210106182822391.0\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.cat
%WINDIR%\winsxs\installtemp\20210106182822422.0\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822422.2\9.0.30729.1.policy
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcp80.dll
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\netvna.inf
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\vna.sys
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\vna_coinstall.dll
%TEMP%\2\trac.config
%TEMP%\2\pireg.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\pireg.exe
%WINDIR%\winsxs\installtemp\20210106182822328.0\atl80.dll
%WINDIR%\winsxs\installtemp\20210106182822328.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat
%WINDIR%\winsxs\installtemp\20210106182822328.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcm80.dll
%WINDIR%\winsxs\installtemp\20210106182822437.2\msvcr80.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.2\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat
%WINDIR%\winsxs\installtemp\20210106182822437.2\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest
%WINDIR%\winsxs\installtemp\20210106182822437.1\8.0.50727.42.cat
%WINDIR%\winsxs\installtemp\20210106182822437.1\8.0.50727.42.policy
%WINDIR%\winsxs\installtemp\20210106182822437.0\8.0.50727.762.cat
%WINDIR%\winsxs\installtemp\20210106182822437.0\8.0.50727.762.policy
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcm90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcp90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\msvcr90.dll
%WINDIR%\winsxs\installtemp\20210106182822406.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat
%WINDIR%\winsxs\installtemp\20210106182822422.2\9.0.30729.1.cat
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\welcome.png
%WINDIR%\syswow64\vsutil.dll
%WINDIR%\syswow64\vsinit.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbarred.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbarorange.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\statusbargreen.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-warning.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-ok.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-notrunning.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-inprogress.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\state-error.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\vpnclient.chm
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.config
%ProgramFiles(x86)%\checkpoint\endpoint connect\tcpip.def
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\endpointbannerbig.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\connlogo.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\about.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\soft.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\site.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarlinkbackground.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbuttonpressed.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbutton.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sidebarbackground.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securityinfoicon.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\endpointbanner.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\securemote\cp_left.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.ddf
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.defaults
%ProgramFiles(x86)%\checkpoint\endpoint connect\trac.exe
%WINDIR%\syswow64\zonelabs\vsdatant.sys
%WINDIR%\syswow64\zonelabs\vsdatant.inf
%WINDIR%\syswow64\zonelabs\vsdatant.cat
%WINDIR%\syswow64\vsdata.dll
%WINDIR%\syswow64\zonelabs\vsconfig.xml
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna.sys
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_install64.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_coinstall.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\ver.ini
%WINDIR%\syswow64\zonelabs\vsdrinst.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\update_config_tool.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\trscvstub.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\trsaa.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\triangle.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\trgui.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\trapi.dll
%ProgramFiles(x86)%\checkpoint\endpoint connect\tracsrvwrapper.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\tracfailed.wav
%ProgramFiles(x86)%\checkpoint\endpoint connect\traccpinfo.cmd
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\tracconnected.wav
%ProgramFiles(x86)%\checkpoint\endpoint connect\traccapi.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\uninstallsecureclient.exe
%ProgramFiles(x86)%\checkpoint\endpoint connect\res\sdl.png
%ProgramFiles(x86)%\checkpoint\endpoint connect\adminmode.bat

Перемещает следующие файлы

%WINDIR%\syswow64\cpepc_plap.dll в <SYSTEM32>\cpepc_plap.dll
%WINDIR%\syswow64\epcginashim.dll в <SYSTEM32>\epcginashim.dll
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set6ed8.tmp в %TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\vna.sys
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set6fd3.tmp в %TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\vna_coinstall.dll
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set70ae.tmp в %TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\netvna.cat
%TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\set71a9.tmp в %TEMP%\{0bffe91f-45b5-72f0-1909-b5660bcdbd09}\netvna.inf

Сетевая активность

Подключается к

'localhost':49179

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'localhost':49180

UDP

DNS ASK microsoft.com

Другое

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna drv unload
'%LOCALAPPDATA%\qb10a784.05\bmail.exe' -s smtp.barceloviajes.com -t despliegues@barceloviajes.com -f despliegues@gmail.com -a "Informe VPN - BV - Equipo: 'rgeciu', Usuario: 'rgeciu\user', Hora: 18:29:55.25" -h -m Informe.txt
'%WINDIR%\syswow64\zonelabs\vsdrinst.exe' -i %WINDIR%\SysWOW64\ZoneLabs\vsdatant.inf
'%ProgramFiles(x86)%\checkpoint\endpoint connect\tracsrvwrapper.exe'
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_install64.exe' changestate cp_apvna 2
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna drv load
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_install64.exe' changestate cp_apvna 1
'%LOCALAPPDATA%\qb10a784.05\msend.exe' -to despliegues@barceloviajes.com -from despliegues@barceloviajes.com -ssl -port 465 -auth -smtp smtp.gmail.com -sub "Informe VPN - BV - Equipo: 'rgeciu', Usuario: 'rgeciu\user', Hora: 18:29:58...
'%LOCALAPPDATA%\qb10a784.05\bp.exe' "Area Tecnica de Sistemas - Barcelo Viajes" "VPN Instalada y configurada. Cierre aplicaciones y reinicie el sistema Gracias." /cerrar
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_install64.exe' install "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\netvna.inf" cp_apvna
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna dev install "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\netvna.inf" cp_apvna
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna dev exist cp_apvna
'%LOCALAPPDATA%\qb10a784.05\bp.exe' "Area tecnologica de Sistemas - Barcelo Viajes" "Instalando y configurando VPN, por favor, espere..." /mostrar
'%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\ScvProxy-64.reg"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%TEMP%\2\Trac.config""' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%TEMP%\2\Pireg.exe""' (со скрытым окном)
'%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\ScvPlugins-64.reg"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\PiReg.exe""' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' config wscsvc start= auto' (со скрытым окном)
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna drv load' (со скрытым окном)
'%WINDIR%\syswow64\net.exe' start TracSrvWrapper' (со скрытым окном)
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna dev exist cp_apvna' (со скрытым окном)
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna drv unload' (со скрытым окном)
'%ProgramFiles(x86)%\checkpoint\endpoint connect\vna_utils.exe' -d -ap vna dev install "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\netvna.inf" cp_apvna' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2928UM7B.cmd" "<Полный путь к файлу>" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2928UM7B.cmd" "<Полный путь к файлу>" "
'%WINDIR%\syswow64\sc.exe' config "PcaSvc" start= auto
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\net1.exe' start TracSrvWrapper
'%WINDIR%\syswow64\net.exe' start TracSrvWrapper
'%WINDIR%\syswow64\sc.exe' config wscsvc start= auto
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\PiReg.exe""
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%TEMP%\2\Pireg.exe""
'%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\ScvProxy-64.reg"
'%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles(x86)%\CheckPoint\Endpoint Connect\ScvPlugins-64.reg"
'%WINDIR%\syswow64\msiexec.exe' /i "%LOCALAPPDATA%\qb10A784.05\vpn8041.msi" /q /norestart /l c:\temp\VPN.log
'%WINDIR%\syswow64\msiexec.exe' /x {729B7AAC-A6B3-40B6-BC59-6594D522CBD2} /quiet
'%WINDIR%\syswow64\sc.exe' config "PcaSvc" start= disabled
'%WINDIR%\syswow64\net1.exe' stop PcaSvc
'%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%TEMP%\2\Trac.config""
'%WINDIR%\syswow64\find.exe' /I "bp.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней