Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-980f8db500f06587\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (980f8db500f06587)\ScreenConnect.WindowsClient.exe" "%1"'
Modifies file system
Creates the following files
- %TEMP%\setup.msi
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\msiff6f.tmp
- %TEMP%\msiff6f.tmp-\screenconnect.installeractions.dll
- %TEMP%\msiff6f.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msiff6f.tmp-\screenconnect.core.dll
- %TEMP%\msiff6f.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~df08ce32a33da97b03.tmp
- %WINDIR%\installer\sourcehash{54f84215-e27f-4690-9737-5008630fc13e}
- %WINDIR%\temp\~df9f75b6dd8ffac64a.tmp
- %WINDIR%\temp\~df98e86ddc0dfb060d.tmp
- %WINDIR%\temp\~df2d91e2b856d5a5a2.tmp
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\app.config
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\client.resources
- %ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\system.config
- %WINDIR%\installer\{54f84215-e27f-4690-9737-5008630fc13e}\defaulticon
- %WINDIR%\temp\~dfdb841a27c41453db.tmp
- %WINDIR%\temp\~dfdf3574663af96f1a.tmp
- %WINDIR%\temp\~df6a78af61392729a9.tmp
- %WINDIR%\temp\~df80aeb3cea699f2e5.tmp
- %WINDIR%\temp\~df23cde7ab77cd7b3c.tmp
- %WINDIR%\temp\~df3cbfca684de80a99.tmp
- %WINDIR%\temp\~dfdca4e70fc0997d90.tmp
- %WINDIR%\temp\~df0f921dadc9fab213.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
- %TEMP%\content\5244-5220-screenconnect.windowsclient.exe-13-16-38-724.dump
- %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\uqovt414.newcfg
- %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\i2g4invo.newcfg
- %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\cnocbt1e.newcfg
Deletes following files that it created itself
- %TEMP%\msiff6f.tmp-\customaction.config
- %TEMP%\msiff6f.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msiff6f.tmp-\screenconnect.core.dll
- %TEMP%\msiff6f.tmp-\screenconnect.installeractions.dll
- %TEMP%\msiff6f.tmp
Moves the following files
- from %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\uqovt414.newcfg to %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config
- from %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\i2g4invo.newcfg to %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config
- from %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\cnocbt1e.newcfg to %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config
Network activity
Connects to
- 'in#########rimu-relay.screenconnect.com':443
TCP
Other
- 'in#########rimu-relay.screenconnect.com':443
UDP
- DNS ASK in#########rimu-relay.screenconnect.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe' "Rerun" "?e=Access&y=Host&h=instance-uirimu-relay.screenconnect.com&p=443&s=d9127958-fd58-46b0-b0a8-ad48fb18391d&k=BgIAAACkAABSU0ExAAgAAAEAAQDNIdhmh9kOrKy58T6hCd1%2bEXhcJ6i43mSo3Vk5%2fB%2bbXZAr...
- '%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe' "?e=Access&y=Host&h=instance-uirimu-relay.screenconnect.com&p=443&s=d9127958-fd58-46b0-b0a8-ad48fb18391d&k=BgIAAACkAABSU0ExAAgAAAEAAQDNIdhmh9kOrKy58T6hCd1%2bEXhcJ6i43mSo3Vk5%2fB%2bbXZAr%2bOXWw5...
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIFF6F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_918281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
