Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'ImagePath' = '"%ProgramFiles(x86)%\Splashtop\Splashtop Remote\SERVER\SRService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\SSUService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SSUService] 'ImagePath' = '%ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe'
Создает следующие сервисы
- 'SplashtopRemoteService' "%ProgramFiles(x86)%\Splashtop\Splashtop Remote\SERVER\SRService.exe"
- 'SplashtopRemoteService' %ProgramFiles(x86)%\Splashtop\Splashtop Remote\SERVER\SRService.exe
- 'SSUService' %ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\unpack.log
- %TEMP%\_is4d61.tmp
- %TEMP%\_is4d60.tmp
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srclient.pem
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\splashtop remote\splashtop streamer.lnk
- %WINDIR%\temp\installutil.log
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\string1033.txt
- %TEMP%\_is2095.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\_isres_0x0409.dll
- %TEMP%\_is2065.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isbew64.exe
- %TEMP%\_is2045.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isrt.dll
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\isconfig.ini
- %TEMP%\_is1ff6.tmp
- %TEMP%\_is1f98.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isconfig.ini
- %TEMP%\_is1f68.tmp
- %WINDIR%\installer\{b7c5ea94-b96a-41f5-be95-25d78b486678}\arpproducticon.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidsupport.reg
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidnotsupport.reg
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd64.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon64.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\wdfcoinstaller01009.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\sthid.sys
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\setup.inx
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isconfig.ini
- %TEMP%\_is54d2.tmp
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\setup.inx
- %ProgramFiles(x86)%\splashtop\splashtop software updater\defaultui.dll
- %ProgramFiles(x86)%\splashtop\splashtop software updater\ssuagent.exe
- %ProgramFiles(x86)%\splashtop\splashtop software updater\ssuapi.dll
- %ProgramFiles(x86)%\splashtop\splashtop software updater\wcxinst.exe
- %ProgramFiles(x86)%\splashtop\splashtop software updater\ssuclient.dll
- %ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe
- %TEMP%\nsh7e55.tmp\system.dll
- %TEMP%\nsr7e44.tmp
- %TEMP%\nsr5e94.tmp
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\string1033.txt
- %TEMP%\_is56fd.tmp
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\string1033.txt
- %TEMP%\_is56fc.tmp
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\_isres_0x0409.dll
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\_isres_0x0409.dll
- %TEMP%\_is56ad.tmp
- %TEMP%\_is569c.tmp
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isbew64.exe
- %TEMP%\_is567c.tmp
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\isbew64.exe
- %TEMP%\_is564c.tmp
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isrt.dll
- %TEMP%\_is560d.tmp
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\setup.inx
- %TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\isrt.dll
- %TEMP%\_is559e.tmp
- %TEMP%\_is5530.tmp
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\hidkmdf.sys
- %ProgramFiles(x86)%\splashtop\splashtop software updater\uninst.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\wdfcoinstaller01009.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver.bat
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\acknowledgements.htm
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\string1033.txt
- %TEMP%\_is102b.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\_isres_0x0409.dll
- %TEMP%\_isfeb.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isbew64.exe
- %TEMP%\_isfdb.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isrt.dll
- %TEMP%\_isf6d.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\setup.inx
- %TEMP%\_isf1e.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isconfig.ini
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\dataproxy.exe
- %TEMP%\_isebf.tmp
- %TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
- %TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
- %TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.dll
- %TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
- %WINDIR%\temp\prever.log.txt
- %WINDIR%\temp\prever.log
- %WINDIR%\temp\unpack.log.txt
- %TEMP%\unpack\uninst.iss
- %TEMP%\unpack\prevercheck.exe
- %TEMP%\unpack\setup.ini
- %TEMP%\unpack\run.bat
- %TEMP%\unpack\setup.msi
- %TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\elevator.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\libcelt-0.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\libx264-116.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.sys
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.inf
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.cat
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver64.bat
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver.bat
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\hidkmdf.sys
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\strlog\splashtop.bl
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappfilehound.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srapped.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappcam.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappbrowser.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappannotation.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srx264wrapper.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdateinstall.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdate.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srsoobe.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.pem
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srsendlog.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srfeature.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srdxgicaptor.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\sraudioresample.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\srappbs.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\spupnp.exe
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\nvfbc.dll
- %ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver64.bat
- %TEMP%\nsh7e55.tmp\ssudesc.xml
Удаляет следующие файлы
- %TEMP%\_isebf.tmp
- %TEMP%\_is4d61.tmp
- %TEMP%\_is54d2.tmp
- %TEMP%\_is5530.tmp
- %TEMP%\_is559e.tmp
- %TEMP%\_is560d.tmp
- %TEMP%\_is564c.tmp
- %TEMP%\_is567c.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\setup.inx
- %TEMP%\_is4d60.tmp
- %TEMP%\_is569c.tmp
- %TEMP%\_is56fd.tmp
- %TEMP%\nsh7e55.tmp\ssudesc.xml
- %TEMP%\nsh7e55.tmp\system.dll
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isbew64.exe
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isrt.dll
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isconfig.ini
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\string1033.txt
- %TEMP%\_is56ad.tmp
- %TEMP%\_is56fc.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\_isres_0x0409.dll
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\string1033.txt
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isconfig.ini
- %TEMP%\_isf6d.tmp
- %TEMP%\_isfdb.tmp
- %TEMP%\_isfeb.tmp
- %TEMP%\_is102b.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isbew64.exe
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isrt.dll
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isconfig.ini
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\string1033.txt
- %TEMP%\_isf1e.tmp
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\_isres_0x0409.dll
- %TEMP%\_is1f68.tmp
- %TEMP%\_is1f98.tmp
- %TEMP%\_is1ff6.tmp
- %TEMP%\_is2045.tmp
- %TEMP%\_is2065.tmp
- %TEMP%\_is2095.tmp
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isbew64.exe
- %TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isrt.dll
- %TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\setup.inx
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\_isres_0x0409.dll
- %TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\setup.inx
Сетевая активность
TCP
Запросы HTTP GET
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Другое
Ищет следующие окна
- ClassName: 'MsiDialogCloseClass' WindowName: ''
- ClassName: '#32770' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\unpack\prevercheck.exe'
- '%TEMP%\{fc7c5111-d6d9-4fa4-ae2a-3bd805d6c1e1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C176C74A-6F16-4304-81DF-A70FAB5E0128}
- '%TEMP%\{947ebdcb-18ac-4465-993e-8abcd254f4c0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F028FCC1-F155-4C07-A46C-63E3C6EF6A09}
- '%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g
- '%TEMP%\{02ac1d00-5d9b-4e86-b09b-1bf10899b1b1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3658B378-D944-44E4-9CC6-B61D70D6AF40}
- '%TEMP%\{c2fe1c0f-a54d-4d36-8b81-eae029e8ee96}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3749B45-F164-40E6-B00A-69A7E0F88C60}
- '%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S
- '%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i
- '%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR
- '%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe'
- '<SYSTEM32>\cmd.exe' /c run.bat > %WINDIR%\Temp\unpack.log.txt' (со скрытым окном)
- '%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g' (со скрытым окном)
- '%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S' (со скрытым окном)
- '%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i' (со скрытым окном)
- '%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c run.bat > %WINDIR%\Temp\unpack.log.txt
- '%WINDIR%\syswow64\msiexec.exe' /i "setup.msi" /qb! /l*v "%WINDIR%\Temp\PreVer.log.txt"
