Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Classes\sc-f3544e736d55563a\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (f3544e736d55563a)\ScreenConnect.WindowsClient.exe" "%1"'
- [HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (f3544e736d55563a)\ScreenConnect.WindowsAuthenticationPackage.dll'
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (f3544e736d55563a)] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (f3544e736d55563a)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (f3544e736d55563a)\ScreenConnect.ClientService.exe" "?e...
Создает следующие сервисы
- 'ScreenConnect Client (f3544e736d55563a)' %ProgramFiles(x86)%\ScreenConnect Client (f3544e736d55563a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-i8v6gd-relay.screenconnect.com&p=443&s=ad63ed01-e23d-4a69-b098-3c96b04...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\setup.msi
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
- %TEMP%\msi526c.tmp
- %TEMP%\msi526c.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi526c.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi526c.tmp-\screenconnect.core.dll
- %TEMP%\msi526c.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~df572ab59364977e22.tmp
- %WINDIR%\installer\sourcehash{1cf1577d-4ad4-4e45-b45c-1bffa8f752c5}
- %WINDIR%\temp\~df4c0ecefec5d30965.tmp
- %WINDIR%\temp\~df01d816b84e27895c.tmp
- %WINDIR%\temp\~dfeaefde1e1b47a9b1.tmp
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\system.config
- %WINDIR%\installer\{1cf1577d-4ad4-4e45-b45c-1bffa8f752c5}\defaulticon
- %WINDIR%\temp\~df2ade9b2bf73b4e40.tmp
- %WINDIR%\temp\~df468b1d359a2e683e.tmp
- %WINDIR%\temp\~df7b31d31a2f84f2bb.tmp
- %WINDIR%\temp\~df2f6fd36a9f353f63.tmp
- %WINDIR%\temp\~df4ddb48fd145400a5.tmp
- %WINDIR%\temp\~df9ffb6be4c5d757dc.tmp
- %WINDIR%\temp\~df22e7910311a2a1e9.tmp
- %WINDIR%\temp\~dff1596485a54acd05.tmp
- %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\sdb2euct.newcfg
- %TEMP%\content\1420-2004-screenconnect.windowsclient.exe-06-38-11-013.dump
- %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\vpucooe0.newcfg
- %WINDIR%\temp\content\4800-4336-screenconnect.windowsclient.exe-06-38-17-788.dump
- %WINDIR%\temp\screenconnect\22.5.7881.8171\screenconnect.clientsetup.exe
- %WINDIR%\systemtemp\screenconnect\25.8.3.9459\f3544e736d55563a\screenconnect.clientsetup.msi
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\screenconnect.clientsetup.exe.log
- %WINDIR%\installer\msi237e.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi237e.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi237e.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi237e.tmp-\customaction.config
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\screenconnect.clientservice.exe.log
- %WINDIR%\temp\~dff6296673665a14e3.tmp
- %WINDIR%\temp\~dfe7b1eb4bfc125abf.tmp
- %WINDIR%\temp\~dfd0a6bb7e0763ca0c.tmp
- %WINDIR%\temp\~df229cf3d493acf1de.tmp
- %WINDIR%\temp\~dfb67eeb125b374675.tmp
- %WINDIR%\temp\~df5257d14657626640.tmp
- %WINDIR%\temp\~dfc8a6cd9685e53cdc.tmp
- %WINDIR%\installer\sourcehash{86fa8567-30d3-a1a0-6373-818531ad34b2}
- %WINDIR%\temp\~df9acab031c1fd048c.tmp
- %WINDIR%\temp\~df10b468638447a0fe.tmp
- %WINDIR%\temp\~dfb453d32f1041644a.tmp
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsauthenticationpackage.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsfilemanager.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsfilemanager.exe.config
- %WINDIR%\installer\{86fa8567-30d3-a1a0-6373-818531ad34b2}\defaulticon
- %WINDIR%\temp\~df0f43ab6cb81ba56e.tmp
- %WINDIR%\temp\~dfe6db8bb1a82b4d28.tmp
- %WINDIR%\temp\~dfb78a631c15eb8c2e.tmp
- %WINDIR%\temp\~df9086026dcf163939.tmp
- %WINDIR%\temp\~df929a5a03992c4edf.tmp
- %WINDIR%\temp\~dfd1eb5ffb28e5bce4.tmp
- %WINDIR%\temp\~df2f5897582e1a5a42.tmp
- %WINDIR%\temp\~df7f04908d6156cd96.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (f3544e736d55563a)\uisvbey2.newcfg
- %TEMP%\content\2416-2948-screenconnect.windowsclient.exe-06-39-03-974.dump
- %TEMP%\content\2416-2948-screenconnect.windowsclient.exe-06-39-04-049.dump
- %TEMP%\content\2416-2948-screenconnect.windowsclient.exe-06-39-04-204.dump
- %WINDIR%\temp\content\3708-3344-screenconnect.windowsclient.exe-06-39-06-047.dump
- %WINDIR%\temp\content\3708-3344-screenconnect.windowsclient.exe-06-39-06-121.dump
- %WINDIR%\temp\content\3708-3344-screenconnect.windowsclient.exe-06-39-06-123.dump
Удаляет файлы, которые сам же создал
- %TEMP%\msi526c.tmp-\customaction.config
- %TEMP%\msi526c.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi526c.tmp-\screenconnect.core.dll
- %TEMP%\msi526c.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi526c.tmp
- %WINDIR%\installer\msi237e.tmp-\customaction.config
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi237e.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi237e.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi237e.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi237e.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\sourcehash{1cf1577d-4ad4-4e45-b45c-1bffa8f752c5}
- %WINDIR%\installer\{1cf1577d-4ad4-4e45-b45c-1bffa8f752c5}\defaulticon
Перемещает следующие файлы
- %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\sdb2euct.newcfg в %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\user.config
- %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\vpucooe0.newcfg в %ALLUSERSPROFILE%\screenconnect client (f3544e736d55563a)\user.config
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.dll в C:\config.msi\f5b20.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.exe в C:\config.msi\f5b21.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe в C:\config.msi\f5b22.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.client.dll в C:\config.msi\f5b23.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.core.dll в C:\config.msi\f5b24.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windows.dll в C:\config.msi\f5b25.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe.config в C:\config.msi\f5b26.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.en-us.resources в C:\config.msi\f5b27.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.override.resources в C:\config.msi\f5b28.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.resources в C:\config.msi\f5b29.rbf
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\system.config в C:\config.msi\f5b2a.rbf
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (f3544e736d55563a)\uisvbey2.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (f3544e736d55563a)\user.config
Подменяет следующие файлы
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\client.resources
- %ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\system.config
Сетевая активность
Подключается к
- 'in#########v6gd-relay.screenconnect.com':443
TCP
Другие
- 'in#########v6gd-relay.screenconnect.com':443
UDP
- DNS ASK in#########v6gd-relay.screenconnect.com
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=instance-i8v6gd-relay.screenconnect.com&p=443&s=ad63ed01-e23d-4a69-b098-3c96b04fad97&k=BgIAAACkAABSU0ExAAgAAAEAAQC1HOgy8v0XDsaS8zobuZKti7ILiI5U7drKJKJTy5gEgzdm9Y4vz2bOwOqx%...
- '%ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe' "RunRole" "fdc01ea8-30b7-4358-a339-7f2628be2255" "User"
- '%ProgramFiles(x86)%\screenconnect client (f3544e736d55563a)\screenconnect.windowsclient.exe' "RunRole" "04d716af-8f60-41f9-a034-0f01c70278d4" "System"
- '%WINDIR%\temp\screenconnect\22.5.7881.8171\screenconnect.clientsetup.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI526C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1004546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '%WINDIR%\syswow64\msiexec.exe' /i "%WINDIR%\SystemTemp\ScreenConnect\25.8.3.9459\f3544e736d55563a\ScreenConnect.ClientSetup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI237E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1058281 28 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
