Trojan.Siggen10.41057

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\CLASSES\st-streamer\shell\open\command] '' = '%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRUtility.exe -a %1'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\SSUService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SSUService] 'ImagePath' = '%ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe'
[<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SplashtopRemoteService] 'ImagePath' = '"%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe"'

Creates the following services

'SSUService' %ProgramFiles(x86)%\Splashtop\Splashtop Software Updater\SSUService.exe
'SplashtopRemoteService' "%ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe"
'SplashtopRemoteService' %ProgramFiles(x86)%\Splashtop\Splashtop Remote\Server\SRService.exe

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM SRServer.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRApp.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRFeature.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRFeatMini.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRManager.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRAgent.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM SRChat.exe /T

Modifies file system

Creates the following files

%TEMP%\unpack.log
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\stvad.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdwmark.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\stvad.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdsmplui.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdnup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdcolman.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdbook.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\stprintmon.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdwmark.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdsmplui.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdscale.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdnup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\64bits\xdscale.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\64bits\stvad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stmirror.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\32bits\stvad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stvideo.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stmirror.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\stmirror.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\installwin7_64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\installwin7.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdcolman.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\32bits\stvad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\stvad.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\stvad.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win7\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\64bits\stvad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvad\win10\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\xdbook.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdsmplui.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdscale.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdnup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdcolman.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdbook.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\stprintmon.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdwmark.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdsmplui.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\64bits\xdwmark.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdscale.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdcolman.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdbook.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\stprintmon.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdwscrgb.icc
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdwmark.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdsmpl.ini
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdsmpl.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdsmpl-pipelineconfig.xml
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\32bits\xdnup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdbook.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdwscrgb.icc
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\utils\prnport.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdwmark.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdsmpl.ini
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdsmpl.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdsmpl-pipelineconfig.xml
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdpgscl.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdnup.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdnames.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdcolman.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\32bits\stprintmon.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\xdcmykprinter.icc
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\stprinter.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\stprinter.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\p_unmount.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\p_mount.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\win10\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stmirror.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stvideo.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\64bits\stvideo.sys
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isconfig.ini
%TEMP%\nshe7b1.tmp\ssudesc.xml
%ProgramFiles(x86)%\splashtop\splashtop software updater\uninst.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\defaultui.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuagent.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuapi.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\wcxinst.exe
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuclient.dll
%ALLUSERSPROFILE%\splashtop\common\event\stevt_srs.dll
%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe
%TEMP%\nshe7b0.tmp
%TEMP%\nssdd93.tmp
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\string1033.txt
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\_isres_0x0409.dll
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isrt.dll
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\setup.inx
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isconfig.ini
%TEMP%\nshe7b1.tmp\system.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srclient.pem
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\setup.inx
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\setup.inx
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isrt.dll
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\setup.inx
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isconfig.ini
%ProgramFiles(x86)%\splashtop\splashtop remote\server\log\svcinfo.txt
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\string1033.txt
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\_isres_0x0409.dll
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isrt.dll
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isconfig.ini
%WINDIR%\temp\{c027ea49-5ef1-4659-a65e-df4236b6a8c1}
%ALLUSERSPROFILE%\splashtop\splashtop software updater\tracking\platform_protossu01.csv
%WINDIR%\temp\{0184d87b-cce1-4196-845e-422c0b9863fe}
%WINDIR%\temp\{030d6b46-3687-47b0-adab-6a3f6058c39e}
%WINDIR%\temp\{6fe4eff7-43a1-4c41-859c-df188d86818e}
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\string1033.txt
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\_isres_0x0409.dll
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isrt.dll
%ALLUSERSPROFILE%\splashtop\common\event\stevt_srs_provider.man
<SYSTEM32>\srcb386.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\splashtop remote\splashtop streamer.lnk
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\hidkmdf.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\support\evtlogprovider\stevt_srs_x86.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\support\evtlogprovider\stevt_srs_x64.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\support\evtlogprovider\stevt_srs_provider.man
%ProgramFiles(x86)%\splashtop\splashtop remote\server\support\credprovider\x86\srcredentialprovider.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\support\credprovider\x64\srcredentialprovider.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappfilehound.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srapped.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappcam.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappbrowser.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\plugin\srappannotation.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\mirror2extend.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stvideo\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\strlog\splashtop.bl
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\sthid.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver.bat
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\instregexp.reg
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidsupport.reg
%TEMP%\installutil.log
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\string1033.txt
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\_isres_0x0409.dll
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isrt.dll
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\setup.inx
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isconfig.ini
%WINDIR%\installer\{b7c5ea94-b96a-41f5-be95-25d78b486678}\arpproducticon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\sthidnotsupport.reg
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\wdfcoinstaller01009.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\sthid.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\64bits\hidkmdf.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\virtualdriver\wdfcoinstaller01009.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdpgscl.gpd
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\_isres_0x0409.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdnup.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdcolman.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdate.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\sruaccheck.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.pem
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srserver.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\sropus.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srmanager.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srupdateinstall.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srfeature.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srdxgihelper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srdxgicaptor.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srdetect.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srchat.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\sraudioresample.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srappbs.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srapp.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\sragent.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srfeatmini.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\64bits\stgamepad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\ssleay32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\enum64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\enum.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srademwrapper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\stgamepad.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\gamepad\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\wbappvidrec.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srutility.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\srx264wrapper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\reboot.bat
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\setup.inx
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x86.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_provider.man
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_uninst.reg
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_inst.reg
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\pinshortcut.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x64.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe
%TEMP%\prever.log.txt
%TEMP%\prever.log
%TEMP%\unpack.log.txt
%TEMP%\unpack\uninst.iss
%TEMP%\unpack\prevercheck.exe
%TEMP%\unpack\setup.ini
%TEMP%\unpack\run.bat
%TEMP%\unpack\setup.msi
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\string1033.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\pinshortcut.exe
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isrt.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\nvfbc.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libx264-116.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libmp4v2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libeay32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\libcelt-0.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\elevator.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\dbghelp.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\amf-vcedem-win32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\pkghelper.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\acknowledgements.htm
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\_isres_0x0409.dll
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isrt.dll
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\setup.inx
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isconfig.ini
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\string1033.txt
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\_isres_0x0409.dll
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isconfig.ini
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_iddcx.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\driver\mv2.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\driver\mv2.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\driver\mv2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\driver\mv2.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\uninstall.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\setupdrv.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\license.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\driver\mv2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp64\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\driver\mv2.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\driver\mv2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\driver\mv2.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\uninstall.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\setupdrv.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\license.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\driver\mv2.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\xp\driver\mv2.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\driver\mv2.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\install_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdcmykprinter.icc
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdbook.gpd
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\stprinter.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\stprinter.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\p_unmount.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\p_mount.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\64bits\stdpms.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\uninstall_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\uninstall_driver.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\monitor\stdpms.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\install_driver64.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\driver\mv2.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\uninstall.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\setupdrv.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\lci_proxywddm.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\lci_proxywddm.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\lci_iddcx.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\lci_iddcx.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x86\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x86\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x86\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x64\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x86\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x64\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x64\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x64\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x64\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x64\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_iddcx.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win10\x86\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x64\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x64\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x64\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\license.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista64\install.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\driver\mv2.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\driver\mv2.inf
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\driver\mv2.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\driver\mv2.cat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\uninstall.bat
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\setupdrv.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\vista\license.txt
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\utils\difxcmd64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x64\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\utils\difxcmd.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\utils\devcon64.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\mirror\utils\devcon.exe
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x86\my_setup.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x86\lci_proxywddm.sys
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x86\lci_proxyumd32.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x86\lci_proxyumd.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\lcidisplay\win7\x86\lci_iddcx.dll
%ProgramFiles(x86)%\splashtop\splashtop remote\server\driver\stprinter\xdnames.gpd
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\string1033.txt

Deletes the following files

%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\setup.inx
%ProgramFiles(x86)%\splashtop\splashtop remote\server\strlog\splashtop.bl
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isrt.dll
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isconfig.ini
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\string1033.txt
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\_isres_0x0409.dll
%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\setup.inx
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_inst.reg
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_uninst.reg
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\instregexp.reg
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\pinshortcut.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_provider.man
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x64.dll
%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x86.dll
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isrt.dll
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isconfig.ini
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\string1033.txt
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\_isres_0x0409.dll
%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\setup.inx
%TEMP%\unpack\prevercheck.exe
%TEMP%\unpack\run.bat
%TEMP%\unpack\setup.ini
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\_isres_0x0409.dll
%TEMP%\unpack\setup.msi
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\string1033.txt
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isrt.dll
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isrt.dll
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isconfig.ini
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\string1033.txt
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\_isres_0x0409.dll
%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\setup.inx
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isrt.dll
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isconfig.ini
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\string1033.txt
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\_isres_0x0409.dll
%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\setup.inx
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isrt.dll
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isconfig.ini
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\string1033.txt
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\_isres_0x0409.dll
%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\setup.inx
%TEMP%\nshe7b1.tmp\ssudesc.xml
%TEMP%\nshe7b1.tmp\system.dll
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isrt.dll
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isconfig.ini
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\string1033.txt
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\_isres_0x0409.dll
%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\setup.inx
%WINDIR%\temp\{6fe4eff7-43a1-4c41-859c-df188d86818e}
%WINDIR%\temp\{0184d87b-cce1-4196-845e-422c0b9863fe}
%WINDIR%\temp\{030d6b46-3687-47b0-adab-6a3f6058c39e}
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe
%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isconfig.ini
%TEMP%\unpack\uninst.iss

Moves the following files

from <SYSTEM32>\srcb386.tmp to <SYSTEM32>\srcredentialprovider.dll

Network activity

Connects to

'ds#.##vicevm.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://sn.###ashtop.com/file_system/apt_repository/dists/ProtoSSU01/released/binary-i386/Packages.gz

UDP

DNS ASK microsoft.com
DNS ASK sn.###ashtop.com
DNS ASK ds#.##vicevm.com

Miscellaneous

Searches for the following windows

ClassName: 'MsiDialogCloseClass' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB8D4E0A-16B5-4603-BF9C-834D212B2127}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FB22101A-AF28-4F41-8935-EE6D6EEE11DB}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{93A893A5-F676-4E08-94EA-A65788FEA832}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8067DFA-2CA3-40F7-A93B-756D52E974D1}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9886984E-AF0F-4220-9162-63EDF1C9ACAC}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67EF099D-A5B5-49ED-B470-EDB4252A7091}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{929A6640-5504-49FC-B361-3A60C23A570C}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A88281AD-60F2-494A-89E2-C5F414FE31F6}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B208443-280A-44D9-97BD-D4C07B883D27}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C5CFD61-7C2E-411E-A8F5-86A45DB28F11}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6384D1BD-74E2-4472-B79B-3BDB92EFFE5C}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{586EBEBB-25D0-4CD7-BE7C-4AF62FB11DC5}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26CF0821-3680-4A32-80D9-414535E4E75A}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{356E663B-E413-4D2E-9EED-403AF70CBF9F}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16F6C689-681B-429A-8D6C-CA24E526953B}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3CFFF884-613A-456E-B23A-5728CC8AC7AF}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ADD8AFA6-138B-4126-9D90-DEC287F94BED}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA766EEC-4F5E-4029-B392-298B0DEE0B97}
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BDE24C43-7628-4D0A-A422-1C8E6C5F97FB}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0A45E87F-50B5-451C-98B8-980816C21E2A}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64324D0D-03BC-42D9-9477-9C455109710C}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3FA4CF26-AF2C-4ADB-8F7C-05B909AF3E4E}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B00ABFF-8EC8-4768-8A0B-1594768661FC}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1A86B00-A0EE-4331-8132-444A2F8640D7}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{697AE9FD-0DA9-4F7D-9543-A447388AC6CA}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21ABB37D-2FCE-407D-BCCA-3B6BA26E13CC}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E76DAAB9-5C28-42C5-93DA-0BA2F67E0972}
'%TEMP%\{c51bc21e-641d-40a9-9ee6-d9eb85fadc92}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D04CC368-62DA-436C-A2C3-1BCC6275CF35}
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srmanager.exe'
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{717DF15A-2079-4876-8C28-F26D36BA1965}
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{72ECF360-F436-4229-97DC-EC338FE41EFD}
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe'
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F9734244-2E4A-44C8-A74D-4A5E6B14F77F}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B5974C9-B11E-42D5-940E-F109EB126987}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32BF48D6-51F2-492A-A2E2-23904C0B3151}
'%TEMP%\{a2fbadd5-c914-4161-8681-6bfd01b5a9c4}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{37CC4C9A-8F98-4A3A-81F3-11EA83901538}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A070B854-AC24-47C3-AF45-7E249F368307}
'%ProgramFiles(x86)%\splashtop\splashtop software updater\ssuservice.exe'
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5571182-088F-474A-9C1D-A9592E9CD6D4}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4440AF36-8488-43FC-9D0B-6DF1E78FF26F}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B1E699D-CE4A-405B-BA95-B81E8010B368}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8845F32E-D197-4E5A-B257-120390EB6E3C}
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -r
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g
'%TEMP%\{1c6f7457-eb02-4b16-8ee2-4af5ce6be4b0}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD64B352-2635-4950-90B2-8173F15F34C9}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99287C1D-F774-4B35-83C9-D5BCEC0962B8}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8DF92EF8-ABDF-4F74-A87E-CF58E2B95021}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{08856231-F48A-44A7-A9F0-D8EC7DA17178}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{63982D9D-91F5-46E4-A2F2-16C6F622A438}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{141EFB7C-14AD-4AA1-B5E7-5DDECF56AA78}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89F0196B-C5E1-41C7-99E8-4E7C870FE3D6}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{54169BB7-27F5-4293-AE3A-2D48985DA0CF}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95591CFC-1886-456C-B216-94619610249E}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{76CFA4C7-114E-4FE2-8CE2-3CB0593B699D}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF255D87-1DC9-48C1-917C-9E8EBE7D29DC}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D36AF4E8-CFCE-4E28-A62E-0946C2FB4D45}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7BAC5CB-85FC-496D-AF82-706527BAB68D}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84FAFA48-53BB-45CB-AC69-4B568FA71D61}
'%TEMP%\{0c1eead2-d467-44fb-a1c8-1405908d3262}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DA4DFB1-806B-4783-A3EF-AC6F7B12989B}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92C5D71B-DC7B-44BA-8749-29E1290C2C1A}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A997773C-1B93-4AD9-BED4-87CA01875B91}
'%TEMP%\{149f05c1-88b4-4542-ab3b-19b2461ad55a}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B287E046-C242-45A4-A6A1-66BDA161E674}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6356086C-9926-43C4-823C-E17DAE9441ED}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E6B1621-5D3B-438F-A3B4-884FCA03F7D7}
'%TEMP%\unpack\prevercheck.exe'
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07B0A135-6D84-44D9-BB5F-7B720C087A21}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FFC87FA1-B2B1-4C45-A84B-C5AD0A9AC03C}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B9F45D7-71CF-4988-802A-1DB98362AF7C}
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe' /P ST_EVENT
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0606148D-53D2-4EA7-9BC0-925E2FF440EB}
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe' /P USERSESSIONID
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B30A15D-1D9B-466C-8FF4-BB4563D62A3E}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A3541DF-8DEF-4AB6-8F7D-0C18CDB5E157}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2F4A840F-A723-4516-B939-5A26B913FB7A}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B82D53D1-BAAF-4B65-ABE9-69470D3628F7}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{355C9D3D-951B-4933-9104-366B7F80083D}
'%TEMP%\{55b6f1f7-c012-4fd8-a50b-42fe4803bae9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E481AA38-D6EF-4216-A769-52AB700FD299}
'%TEMP%\{2770ed47-a569-4f55-9712-83e8214fe630}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5041ED69-6199-4874-AFCD-22CBDFFEF8F6}
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRManager.exe /T"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeatMini.exe /T"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeature.exe /T"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRApp.exe /T"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRServer.exe /T"' (with hidden window)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -r' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRAgent.exe /T"' (with hidden window)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srselfsigncertutil.exe' -g' (with hidden window)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srmanager.exe' ' (with hidden window)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe' /S /Caller=SVR' (with hidden window)
'%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wevtutil.exe im "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"' (with hidden window)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe' /P ST_EVENT' (with hidden window)
'%WINDIR%\syswow64\reg.exe' import "%TEMP%\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\CredProvider_Inst.reg" /reg:64' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wevtutil.exe um "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"' (with hidden window)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe' /P USERSESSIONID' (with hidden window)
'%TEMP%\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe' /S' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRChat.exe /T"' (with hidden window)
'%ProgramFiles(x86)%\splashtop\splashtop remote\server\srservice.exe' -i' (with hidden window)
'<SYSTEM32>\cmd.exe' /c run.bat > "%TEMP%\unpack.log.txt"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c run.bat > "%TEMP%\unpack.log.txt"
'%WINDIR%\syswow64\msiexec.exe' /norestart /i "setup.msi" /qb! /l*v "%TEMP%\PreVer.log.txt" CA_EXTPATH=1
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRServer.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRApp.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeature.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeatMini.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRManager.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRAgent.exe /T"
'%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRChat.exe /T"
'%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg"
'%WINDIR%\syswow64\reg.exe' import "%TEMP%\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\CredProvider_Inst.reg" /reg:64
'<SYSTEM32>\cmd.exe' /C wevtutil.exe um "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"
'<SYSTEM32>\wevtutil.exe' um "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"
'<SYSTEM32>\cmd.exe' /C wevtutil.exe im "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"
'<SYSTEM32>\wevtutil.exe' im "%ALLUSERSPROFILE%\Splashtop\Common\Event\stevt_srs_provider.man"

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial