Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-a866044671ef161d\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (a866044671ef161d)\ScreenConnect.WindowsClient.exe" "%1"'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (a866044671ef161d)] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (a866044671ef161d)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (a866044671ef161d)\ScreenConnect.ClientService.exe" "?e...
Creates the following services
- 'ScreenConnect Client (a866044671ef161d)' "%ProgramFiles(x86)%\ScreenConnect Client (a866044671ef161d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uyfuhq-relay.screenconnect.com&p=443&s=6531eb95-906e-4664-b904-2c9e86...
Modifies file system
Creates the following files
- %TEMP%\setup.msi
- %WINDIR%\temp\tar3e1f.tmp
- %WINDIR%\temp\cab5430.tmp
- %WINDIR%\temp\tar5431.tmp
- %WINDIR%\temp\cab5480.tmp
- %WINDIR%\temp\tar5481.tmp
- %WINDIR%\temp\cab6a72.tmp
- %WINDIR%\temp\tar6a82.tmp
- %WINDIR%\temp\screenconnect\6.6.18120.6697\screenconnect.clientsetup.exe
- %WINDIR%\temp\setup.msi
- %WINDIR%\installer\msic02b.tmp-\screenconnect.installeractions.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\app.config
- %WINDIR%\installer\msic02b.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msic02b.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msic02b.tmp-\customaction.config
- %WINDIR%\temp\~df049d347bbf450782.tmp
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\system.config
- %WINDIR%\installer\{170d959e-a66e-4789-9add-dd377d5d67e6}\defaulticon
- %WINDIR%\temp\~df693ac1ba688d34a1.tmp
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\c17440e7c34ac50f34ca7cf8a43170a0_d4602615-9d50-4880-be41-678935e93eaa
- %WINDIR%\temp\tar3dc0.tmp
- %WINDIR%\temp\cab3e0f.tmp
- %WINDIR%\temp\cab3dbf.tmp
- %WINDIR%\temp\tar27ce.tmp
- %WINDIR%\temp\cab27cd.tmp
- %TEMP%\msi9b74.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi9b74.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi9b74.tmp-\screenconnect.core.dll
- %TEMP%\msi9b74.tmp-\customaction.config
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe.config
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (a866044671ef161d)\biahaurd.newcfg
- %WINDIR%\installer\msic02b.tmp-\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.resources
- %WINDIR%\installer\{a9db558c-dc39-44ee-afc3-8ee30ec34dcf}\defaulticon
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\74fbf93595cfc8459196065ce54ad928
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\74fbf93595cfc8459196065ce54ad928
- %WINDIR%\temp\cab1045.tmp
- %WINDIR%\temp\tar1046.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\msi9b74.tmp
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.en-us.resources
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d140c174325ac9a0229a49c01b719a1b_d4602615-9d50-4880-be41-678935e93eaa
Deletes the following files
- %TEMP%\msi9b74.tmp-\customaction.config
- %WINDIR%\installer\{a9db558c-dc39-44ee-afc3-8ee30ec34dcf}\defaulticon
- %WINDIR%\installer\msic02b.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msic02b.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msic02b.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msic02b.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msic02b.tmp-\customaction.config
- %WINDIR%\temp\tar6a82.tmp
- %WINDIR%\temp\cab6a72.tmp
- %WINDIR%\temp\tar5481.tmp
- %WINDIR%\temp\cab5480.tmp
- %WINDIR%\temp\tar5431.tmp
- %WINDIR%\temp\cab5430.tmp
- %WINDIR%\temp\tar3e1f.tmp
- %WINDIR%\temp\cab3e0f.tmp
- %WINDIR%\temp\tar3dc0.tmp
- %WINDIR%\temp\cab3dbf.tmp
- %WINDIR%\temp\tar27ce.tmp
- %WINDIR%\temp\cab27cd.tmp
- %WINDIR%\temp\tar1046.tmp
- %WINDIR%\temp\cab1045.tmp
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\app.config
- %TEMP%\msi9b74.tmp
- %TEMP%\msi9b74.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi9b74.tmp-\screenconnect.core.dll
- %TEMP%\msi9b74.tmp-\microsoft.deployment.windowsinstaller.dll
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\c17440e7c34ac50f34ca7cf8a43170a0_d4602615-9d50-4880-be41-678935e93eaa
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d140c174325ac9a0229a49c01b719a1b_d4602615-9d50-4880-be41-678935e93eaa
Moves the following files
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.dll to C:\config.msi\da7ed.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.exe to C:\config.msi\da7ee.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe to C:\config.msi\da7ef.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.client.dll to C:\config.msi\da7f0.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.core.dll to C:\config.msi\da7f1.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windows.dll to C:\config.msi\da7f2.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe.config to C:\config.msi\da7f3.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.en-us.resources to C:\config.msi\da7f4.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.en-us.resources to C:\config.msi\da7f5.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.resources to C:\config.msi\da7f6.rbf
- from %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.resources to C:\config.msi\da7f7.rbf
- from %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (a866044671ef161d)\biahaurd.newcfg to %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (a866044671ef161d)\user.config
Substitutes the following files
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\app.config
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\client.resources
Network activity
Connects to
- 'microsoft.com':80
- 'in#########fuhq-relay.screenconnect.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'in#########fuhq-relay.screenconnect.com':443
UDP
- DNS ASK microsoft.com
- DNS ASK in#########fuhq-relay.screenconnect.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=instance-uyfuhq-relay.screenconnect.com&p=443&s=6531eb95-906e-4664-b904-2c9e86fac653&k=BgIAAACkAABSU0ExAAgAAAEAAQCvpBTOtpUjVhSul95tA81%2f4ggdMuaqdQSWVr0XkbEg2Fd%2bEDktUxOLv...
- '%ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe' "RunRole" "6536b8be-7860-4b42-8b6b-51fe064f0657" "User"
- '%ProgramFiles(x86)%\screenconnect client (a866044671ef161d)\screenconnect.windowsclient.exe' "RunRole" "10d25dcb-b49e-4ebf-b24a-62f9e3771f2e" "System"
- '%WINDIR%\temp\screenconnect\6.6.18120.6697\screenconnect.clientsetup.exe'
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI9B74.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_892637 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '%WINDIR%\syswow64\msiexec.exe' /i "%WINDIR%\TEMP\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIC02B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_967190 26 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
