Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Cisco AnyConnect Secure Mobility Agent for Windows' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpn...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'ImagePath' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"'
- [<HKLM>\System\CurrentControlSet\Services\acsock] 'ImagePath' = 'system32\DRIVERS\acsock64.sys'
- [<HKLM>\System\CurrentControlSet\Services\vpnva] 'ImagePath' = 'system32\DRIVERS\vpnva64-6.sys'
Создает следующие сервисы
- 'vpnagent' "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"
- 'vpnagent' %ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
- 'acsock' system32\DRIVERS\acsock64.sys
- 'vpnva' system32\DRIVERS\vpnva64-6.sys
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\3ade.tmp\3aee.bat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-file-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-handle-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-heap-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-debug-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-errorhandling-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-interlocked-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-memory-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-namedpipe-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-processenvironment-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-processthreads-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-libraryloader-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-rtlsupport-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-profile-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vcruntime140.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnapishim.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acdownloader.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper64.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_chrono-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-console-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\noncompliant.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-datetime-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_date_time-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_thread-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\concrt140.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\msvcp140.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vccorlib140.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_filesystem-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_signals-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\boost_system-vc140-mt-1_59.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-string-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\ucrtbase.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acruntime.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\~isco anyconnect secure mobility client.tmp
- <DRIVERS>\set195.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\temp\uddb07.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\updatecomponentmanifest.json
- <DRIVERS>\etc\hosts.ac.tmp
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set30b1.tmp
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set312f.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\temp\udd61df.tmp
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set3024.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-string-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-timezone-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-util-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-conio-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-sysinfo-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-private-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-process-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64-6.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_noncompliant.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_vpn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncli.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnapi.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gui.ico
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\profile\anyconnectprofile.xsd
- %ALLUSERSPROFILE%\microsoft\event viewer\views\cisco\ciscoanyconnect.xml
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\update.txt
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\cues_bg.jpg
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagentutilities.dll
- %WINDIR%\syswow64\vpncategories.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnipsec.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommoncrypt.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down.png
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-gina-predeploy-k9.msi
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-posture-predeploy-k9.msi
- %TEMP%\3ade.tmp\panasonic-bp.xml
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-core-vpn-predeploy-k9.msi
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-core-vpn.log
- %TEMP%\{39136da2-1902-4d1f-add6-3963dacecb6a}.bat
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-dart-predeploy-k9.msi
- %TEMP%\aibb_{158b6ce6-296e-4ac9-ac51-92e9b8d39ba0}_1452.tmp
- %WINDIR%\syswow64\vpnevents.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\zlib1.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommon.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscocrypto.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscossl.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\vpnmanifest.dat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\api-ms-win-core-synch-l1-1-0.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\ac_sock_fltr_api.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_attention.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_2.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo_alt.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_connected.ico
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\eula.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_nam.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\app_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpndownloader.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_3.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_1.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\neutral.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_error.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_good.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_neutral.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_transition.png
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\vpnmanifestclient.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down-solid.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\uninstall.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\opensource.html
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_trusted.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\attention.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gradient.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\error.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.cat
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-dart.log
Присваивает атрибут 'скрытый' для следующих файлов
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Удаляет следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf10ed6a.tmp
- %WINDIR%\temp\uddb07.tmp
- <DRIVERS>\etc\hosts.ac.tmp
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva-6.cat
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva-6.inf
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva64-6.sys
- %WINDIR%\temp\udd61df.tmp
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-dart-predeploy-k9.msi
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-gina-predeploy-k9.msi
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-posture-predeploy-k9.msi
- %TEMP%\3ade.tmp\panasonic-bp.xml
- %TEMP%\3ade.tmp\anyconnect-win-4.5.02036-core-vpn-predeploy-k9.msi
- %TEMP%\3ade.tmp\3aee.bat
Перемещает следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk в %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf10ed6a.tmp
- <DRIVERS>\set195.tmp в <DRIVERS>\acsock64.sys
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set3024.tmp в %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva64-6.sys
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set30b1.tmp в %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva-6.cat
- %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\set312f.tmp в %TEMP%\{5fc946cd-ef6e-640f-e3b2-850513e26441}\vpnva-6.inf
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Подменяет следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
Сетевая активность
Подключается к
- 'microsoft.com':80
- 'mu#.#isco.com':80
UDP
- DNS ASK microsoft.com
- DNS ASK mu#.#isco.com
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' kdf -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsock
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestSBL.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acl "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect VPN Client\update.txt" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect VPN Client\vpndownloader.exe" "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe'
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acpolgen bd=false fm=false rpc=false rtp=false rwl=false sct=false epf=false ewn=false emn=false efn=false upsu=true upcu=true upvp=true upip=true upsp=true upal= ecc=false
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -netwait
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect Secure Mobility Client" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\ACManifestPOS.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%TEMP%\3ADE.tmp\Profiles\feedback\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\CustomerExperienceFeedback\\" "CustomerExperience_Feedback.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%TEMP%\3ADE.tmp\Profiles\vpn\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%TEMP%\3ADE.tmp\Profiles\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Script\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%LOCALAPPDATA%\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "%LOCALAPPDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -registerdll "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\3ADE.tmp\3AEE.bat <Полный путь к файлу>"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\3ADE.tmp\3AEE.bat <Полный путь к файлу>"
- '<SYSTEM32>\msiexec.exe' /package anyconnect-win-4.5.02036-core-vpn-predeploy-k9.msi DISABLE_CUSTOMER_EXPERIENCE_FEEDBACK=1 /norestart /passive /lvx* anyconnect-win-4.5.02036-core-vpn.log
- '%WINDIR%\syswow64\cmd.exe' "%TEMP%\{39136DA2-1902-4D1F-ADD6-3963DACECB6A}.bat"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\msiexec.exe' /package anyconnect-win-4.5.02036-dart-predeploy-k9.msi /norestart /passive /lvx* anyconnect-win-4.5.02036-dart.log
- '<SYSTEM32>\msiexec.exe' /package anyconnect-win-4.5.02036-gina-predeploy-k9.msi /norestart /passive /lvx* anyconnect-win-4.5.02036-gina.log
- '<SYSTEM32>\msiexec.exe' /Y "%WINDIR%\SysWOW64\vpnplap64.dll"
- '<SYSTEM32>\msiexec.exe' /package anyconnect-win-4.5.02036-posture-predeploy-k9.msi /norestart /passive /lvx* anyconnect-win-4.5.02036-posture.log
- '%WINDIR%\syswow64\cmd.exe' "%TEMP%\{A460CE19-9D2E-4839-AB28-14B3EF215EBF}.bat"
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Cisco\Cisco HostScan\bin\CSDWebInstaller.ocx"
