Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Cisco AnyConnect Secure Mobility Agent for Windows' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpn...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vpnagent] 'ImagePath' = '"%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"'
- [<HKLM>\System\CurrentControlSet\Services\acsock] 'ImagePath' = 'system32\DRIVERS\acsock64.sys'
- [<HKLM>\System\CurrentControlSet\Services\vpnva] 'ImagePath' = 'system32\DRIVERS\vpnva64-6.sys'
- 'vpnagent' "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"
- 'vpnagent' %ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
- 'acsock' system32\DRIVERS\acsock64.sys
- 'vpnva' system32\DRIVERS\vpnva64-6.sys
- 'tunnel' system32\DRIVERS\tunnel.sys
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe' -i "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acl "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" -r
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect VPN Client\update.txt" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -createLink "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect VPN Client\vpndownloader.exe" "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe'
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -acpolgen bd=false fm=false rpc=false rtp=false rwl=false sct=false epf=false ewn=false emn=false efn=false upsu=true upcu=true upvp=true upip=true upsp=true upal= ecc=false
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe' kdf -install "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsock
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\feedback\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\CustomerExperienceFeedback\\" "CustomerExperience_Feedback.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\vpn\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -copyFiles "%HOMEPATH%\Downloads\Profiles\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Script\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveFiles "%ALLUSERSPROFILE%\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe' -moveIfExist "%LOCALAPPDATA%\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "%LOCALAPPDATA%\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
- '%ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe'
- '%HOMEPATH%\downloads\ezconnect.exe'
- %HOMEPATH%\downloads\cisco.msi
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs_hover.png
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\eula.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\app_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo_alt.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_prefs.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acfeedback.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\vpn_connected.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_3.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_2.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\transition_1.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\neutral.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\error.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\attention.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_help_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toolbar_about_hover.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_nam.png
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set2666.tmp
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set256b.tmp
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set2423.tmp
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xml
- %WINDIR%\temp\uddf150.tmp
- <DRIVERS>\sete8f7.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\~isco anyconnect secure mobility client.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper64.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\acdownloader.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnapishim.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_noncompliant.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\noncompliant.ico
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva64-6.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnva-6.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\toast_vpn.png
- %WINDIR%\temp\udd7253.tmp
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_trusted.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\opensource.html
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\uninstall.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnapi.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncli.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\installhelper.exe
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\update.txt
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpndownloader.exe
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\profile\anyconnectprofile.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vacon64.exe
- %ALLUSERSPROFILE%\microsoft\event viewer\views\cisco\ciscoanyconnect.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommoncrypt.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscossl.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acciscocrypto.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpncommon.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\zlib1.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnui.exe
- %WINDIR%\syswow64\vpnevents.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagent.exe
- %HOMEPATH%\downloads\ezconnect.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gui.ico
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\anyconnectlocalpolicy.xsd
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\vpnagentutilities.dll
- %WINDIR%\syswow64\vpncategories.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\gradient.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\about.png
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\vpnmanifestclient.xml
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_transition.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_neutral.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_good.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_error.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\status_ico_attention.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.cat
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.inf
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\acsock64.sys
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\ac_sock_fltr_api.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\company_logo.png
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\manifesttool.exe
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\cues_bg.jpg
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\plugins\vpnipsec.dll
- %ProgramFiles(x86)%\cisco\cisco anyconnect secure mobility client\res\mftogglebtn-down-solid.png
- %ALLUSERSPROFILE%\cisco\cisco anyconnect secure mobility client\vpnmanifest.dat
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf10d7d7.tmp
- %WINDIR%\temp\uddf150.tmp
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva-6.cat
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva-6.inf
- %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva64-6.sys
- %WINDIR%\temp\udd7253.tmp
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk to %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk~rf10d7d7.tmp
- from <DRIVERS>\sete8f7.tmp to <DRIVERS>\acsock64.sys
- from %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set2423.tmp to %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva64-6.sys
- from %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set256b.tmp to %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva-6.cat
- from %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\set2666.tmp to %TEMP%\{21078531-a6aa-5023-5598-ab4beb571b78}\vpnva-6.inf
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cisco\cisco anyconnect secure mobility client\cisco anyconnect secure mobility client.lnk
- 'vc#######re.s3.amazonaws.com':80
- 'vc#######re.s3.amazonaws.com':443
- 'microsoft.com':80
- 'mu#.#isco.com':80
- 'vc#######re.s3.amazonaws.com':443
- DNS ASK vc#######re.s3.amazonaws.com
- DNS ASK microsoft.com
- DNS ASK mu#.#isco.com
- '<SYSTEM32>\msiexec.exe' /i "%HOMEPATH%\Downloads\Cisco.msi" /qn
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o