Trojan.Siggen10.61634

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\SSUService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SSUService] 'ImagePath' = '%ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe'

Creates the following services

'SSUService' %ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "SWXDAgent.exe" /t

Modifies file system

Creates the following files

%TEMP%\unpack.log
%ProgramFiles(x86)%\splashtop\splashtop software updater\wcxinst.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuclient.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe
%TEMP%\nsxdeeb.tmp\system.dll
%TEMP%\nshdeda.tmp
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\string1033.txt
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\_isres_0x0409.dll
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isrt.dll
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\setup.inx
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isconfig.ini
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuapi.dll
%WINDIR%\installer\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\arpproducticon.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x86\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x86\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x86\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x86\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x64\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x64\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x64\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x64\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x64\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\lci_proxywddm.inf
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\lci_proxywddm.cat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\x86\my_setup.dll
%WINDIR%\temp\{57d12152-ccee-4812-aa32-6f019064b613}
%WINDIR%\temp\cab7275.tmp
%ProgramFiles(x86)%\splashtop\splashtop software updater\uninst.exe
%WINDIR%\temp\tar7235.tmp
%WINDIR%\temp\cab7234.tmp
%WINDIR%\temp\tar7214.tmp
%WINDIR%\temp\cab7213.tmp
%TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\set592b.tmp
%TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\set5811.tmp
%TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set562c.tmp
%TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set5522.tmp
%TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set5428.tmp
%LOCALAPPDATA%\splashtop\splashtop wired xdisplay\swxdlog.txt
%WINDIR%\temp\{49f7cf1c-54a6-440f-aa97-cfda455f70e6}
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\lci_iddcx.inf
%ALLUSERSPROFILE%\splashtop\splashtop software updater\tracking\platform_protossu01.csv
%WINDIR%\temp\{1a8d0175-4f61-4f0c-bec7-47bc67d817a1}
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\splashtop wired xdisplay agent.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\splashtop wired xdisplay\splashtop wired xdisplay agent.lnk
%WINDIR%\temp\{04edbaf0-cee4-4317-aa82-8e264fa47982}
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\string1033.txt
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\_isres_0x0409.dll
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isrt.dll
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\setup.inx
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isconfig.ini
%TEMP%\nsxdeeb.tmp\ssudesc.xml
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuagent.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\defaultui.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win7\lci_iddcx.cat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libxml2.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libplist.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libimobiledevice.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libiconv.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\adbwinusbapi.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\adbwinapi.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\adb.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\acknowledgements.htm
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\string1033.txt
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\_isres_0x0409.dll
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isrt.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libusbmuxd.dll
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\setup.inx
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\whatsnew.rtf
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\splashtop_software_updater.exe
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\slrutil.exe
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\description.xml
%TEMP%\preverc.log.txt
%TEMP%\preverc.log
%TEMP%\unpack.log.txt
%TEMP%\unpack\prevercheck.exe
%TEMP%\unpack\setup.ini
%TEMP%\unpack\run.bat
%TEMP%\unpack\setup.msi
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isconfig.ini
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x86\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\prevercheck.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x86\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x86\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x86\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x64\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x64\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x64\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x64\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x64\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\lci_proxywddm.inf
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\lci_proxywddm.cat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\lci_iddcx.inf
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\x86\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\win10\lci_iddcx.cat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\uninstall_64.bat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\uninstall.bat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\install_64.bat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\driver\install.bat
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\swxdagent.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\srx264wrapper.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\srupdate.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\srunpackfile.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\srmergefile.exe
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\srdxgicaptor.dll
%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\libx264-116.dll
%WINDIR%\temp\tar7276.tmp

Deletes the following files

%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\setup.inx
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\description.xml
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\slrutil.exe
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\splashtop_software_updater.exe
%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\whatsnew.rtf
%TEMP%\unpack\prevercheck.exe
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isrt.dll
%TEMP%\unpack\run.bat
%TEMP%\unpack\setup.msi
%WINDIR%\temp\cab7213.tmp
%WINDIR%\temp\tar7214.tmp
%WINDIR%\temp\cab7234.tmp
%WINDIR%\temp\tar7235.tmp
%WINDIR%\temp\cab7275.tmp
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\string1033.txt
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\_isres_0x0409.dll
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isconfig.ini
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isrt.dll
%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isconfig.ini
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\string1033.txt
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\_isres_0x0409.dll
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\setup.inx
%TEMP%\nsxdeeb.tmp\ssudesc.xml
%TEMP%\nsxdeeb.tmp\system.dll
%WINDIR%\temp\tar7276.tmp
%TEMP%\unpack\setup.ini
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\string1033.txt
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\_isres_0x0409.dll
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\setup.inx
%WINDIR%\temp\{04edbaf0-cee4-4317-aa82-8e264fa47982}
%WINDIR%\temp\{57d12152-ccee-4812-aa32-6f019064b613}
%WINDIR%\temp\{1a8d0175-4f61-4f0c-bec7-47bc67d817a1}
%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isrt.dll
%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isconfig.ini
%WINDIR%\temp\{49f7cf1c-54a6-440f-aa97-cfda455f70e6}

Moves the following files

from %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set5428.tmp to %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\lci_proxyumd.dll
from %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set5522.tmp to %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\lci_proxyumd32.dll
from %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\set562c.tmp to %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\x64\lci_proxywddm.sys
from %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\set5811.tmp to %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\lci_proxywddm.cat
from %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\set592b.tmp to %TEMP%\{7438a9a6-46f7-6b7c-9168-c76370b2960b}\lci_proxywddm.inf

Network activity

Connects to

'ds#.##vicevm.com':80
'localhost':27015

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://sn.###ashtop.com/file_system/apt_repository/dists/ProtoSSU01/released/binary-i386/Packages.gz

UDP

DNS ASK microsoft.com
DNS ASK sn.###ashtop.com
DNS ASK ds#.##vicevm.com

Miscellaneous

Searches for the following windows

ClassName: 'MsiDialogCloseClass' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4B7FA977-BFB0-4FBF-AC88-993B5AEBE7D5}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E76FE382-9434-434A-B123-82F80DC4FD99}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{48DBDE2C-80D1-455E-ACF5-F3214225CCA7}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B25777A-4F22-41CA-B24D-CA5B91507597}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12807AD7-3CFC-41C0-8BFD-172D5EDA7632}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5EFAB0F8-789A-458F-8833-B4BBA9DE555B}
'%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe'
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{29094D5C-8368-4822-B9B9-777D843BA267}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{97700410-F63B-4F1C-AD45-361654E6683A}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{426E34D9-2900-485F-B5F6-B1183A8F7305}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A90EF56-5737-4D06-A8E8-6AA4A1AE2DFE}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9486AE6C-EC3D-4409-9EDE-3B04055E86EF}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2541D6E-4897-4B27-90CD-DCDACE6FFE42}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{601B68FB-08AF-40F0-A8DC-7C2F2F54A824}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95CC00C0-EAC0-4D10-BABE-68B33E14DD67}
'%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\splashtop_software_updater.exe' /S /Caller=WXD
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C7B49FB-802E-4F0D-B9B3-50B8E968BD66}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{465942FF-E70B-424F-965D-0D71C03DDE55}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E34B5A92-8B42-43D8-AEC2-F91A912E4819}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC9725A8-487B-4D19-8555-EBAD1707CEB2}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{032FAC82-B0BD-4E47-8861-F53682FCE74C}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{043053EE-A99C-46B3-8D37-F81B63BD65E4}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DDA11CB7-601B-4706-A0B9-42A5226965FB}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{167E340A-FF54-45DA-978F-7C82F49D5029}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5C30DA94-46A3-4D74-AE2A-E9CAC88D4821}
'%TEMP%\unpack\prevercheck.exe'
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA5EA729-5867-41AD-A13B-6A27BE2852DE}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0A619DED-A818-44E4-BB71-7BA7F1C265D3}
'%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\swxdagent.exe' -d
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F1BE956-2CF1-4B09-8075-DCB7C07DC9BF}
'%TEMP%\{fac2efb1-07a4-4d3d-9799-bd5d93fc4408}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2343490C-3E30-4EED-9594-84660A51A2EF}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03C42698-90DF-4FED-B3CE-6BC64D056ADD}
'%TEMP%\{80f41db7-04a6-47b6-aaf9-e03629d91d85}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{060856A6-AA02-4AD1-ACAD-95FDBE9B2EB5}
'%TEMP%\{27ed85ee-8ff8-432a-a9d1-71d8e342dc41}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F969E6B2-F5D4-4D9E-8185-989E9002FC1C}
'%WINDIR%\syswow64\taskkill.exe' /f /im "SWXDAgent.exe" /t' (with hidden window)
'%TEMP%\{d906bc40-9e3f-4d42-8c64-a50db92d46e9}\splashtop_software_updater.exe' /S /Caller=WXD' (with hidden window)
'<SYSTEM32>\cmd.exe' /c run.bat > %TEMP%\unpack.log.txt' (with hidden window)
'%ProgramFiles(x86)%\splashtop\splashtop wired xdisplay\agent\swxdagent.exe' -d' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Splashtop\Splashtop Wired XDisplay\Agent\Driver\install_64.bat"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c run.bat > %TEMP%\unpack.log.txt
'%WINDIR%\syswow64\msiexec.exe' /norestart /i "setup.msi" /qb! /l*v "%TEMP%\PreVerC.log.txt"
'<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Splashtop\Splashtop Wired XDisplay\Agent\Driver\install_64.bat"
'<SYSTEM32>\cmd.exe' /c ver
'<SYSTEM32>\sc.exe' query ddmgr
'<SYSTEM32>\sc.exe' query lci_proxykmd
'<SYSTEM32>\sc.exe' query lci_proxywddm
'<SYSTEM32>\timeout.exe' /t 2 /nobreak
'<SYSTEM32>\rundll32.exe' x64\my_setup.dll do_install_lci_proxywddm
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{3f3133e9-230b-331e-21cf-0f5f8f8fab39} Global\{07482631-0fe1-67d6-ce41-732eed413c40} <DRIVERSTORE>\Temp\{42be0b86-122c-7050-4035-4c25...

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial