Trojan.Siggen17.39148

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\REMOTEPCPRINTER] 'Driver' = 'RemotePCmon.dll'

Creates or modifies the following files

<SYSTEM32>\tasks\remotepc
<SYSTEM32>\tasks\servicemonitor
<SYSTEM32>\tasks\rpcservicehealthcheck
<SYSTEM32>\tasks\startrpcservice

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\RPCService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RPCService] 'ImagePath' = '"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"'
[<HKLM>\System\CurrentControlSet\Services\RPCPerformanceService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RPCPerformanceService] 'ImagePath' = '%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RPCPerformanceService.exe'
[<HKLM>\System\CurrentControlSet\Services\clr_optimization_v4.0.30319_64] 'Start' = '00000002'

Creates the following services

'RPCService' "%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'RPCService' %ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe
'RPCPerformanceService' %ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RPCPerformanceService.exe

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RPCCodecEngineHost" dir=in action=allow program="%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,p...

Modifies file system

Creates the following files

%TEMP%\is-4vd1u.tmp\<File name>.tmp
%ALLUSERSPROFILE%\remotepc performance host\proxysettings.json
%ALLUSERSPROFILE%\remotepc performance host\settings.json
%WINDIR%\temp\nshf392.tmp\nsprocess.dll
%WINDIR%\temp\nshf392.tmp\simplesc.dll
%ALLUSERSPROFILE%\remotepc performance host\logs\performancesetup.log
%WINDIR%\temp\nshf392.tmp\system.dll
%WINDIR%\temp\nshf392.tmp\logex.dll
%ALLUSERSPROFILE%\remotepc host\codec\remotepcperformance.exe
%ALLUSERSPROFILE%\remotepc host\printersetup\printer.msi
%ALLUSERSPROFILE%\remotepc host\rpcsuite.log
%ProgramFiles(x86)%\remotepc\easyhook32svc.exe
%ProgramFiles(x86)%\remotepc\easyhook64svc.exe
%ProgramFiles(x86)%\remotepc\dragdrop-console.exe
%ProgramFiles(x86)%\remotepc\dragdrop-dll_x64.dll
%ProgramFiles(x86)%\remotepc\dragdrop-dll_x32.dll
%ProgramFiles(x86)%\remotepc host\easyhook.dll
%ProgramFiles(x86)%\remotepc\easyhook.dll
%WINDIR%\temp\nshf392.tmp\nsexec.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\wmfencdeclib.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\licence.txt
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\d3dcompiler_47.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\xaudio2_9redist.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcbhs.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcauthprovider.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcdnd.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpcdatahandler.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\scribbleroverlay.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\rpccodecengine.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcperformanceservice.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\microsoft.xaml.behaviors.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.service.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.service.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.model.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcsuite.model.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepc.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepc.common.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\newtonsoft.json.dll
%ProgramFiles(x86)%\remotepc host\easyload64.dll
%WINDIR%\temp\nshf392.tmp\dotnetchecker.dll
%ProgramFiles(x86)%\remotepc\easyload64.dll
%ProgramFiles(x86)%\remotepc host\is-fkkfo.tmp
%ALLUSERSPROFILE%\remotepc host\is-r6243.tmp
%TEMP%\is-ehc3b.tmp
%TEMP%\is-e5r07.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-gbafl.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-ueq06.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-uh5li.tmp
%ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-a0q19.tmp
%ProgramFiles(x86)%\remotepc host\is-au57l.tmp
%ProgramFiles(x86)%\remotepc host\is-egvk0.tmp
%ProgramFiles(x86)%\remotepc host\is-nkh2t.tmp
%ProgramFiles(x86)%\remotepc host\is-7g0u5.tmp
%ProgramFiles(x86)%\remotepc host\is-jj68e.tmp
%ProgramFiles(x86)%\remotepc host\is-r4gco.tmp
%ProgramFiles(x86)%\remotepc host\is-mvc7l.tmp
%ProgramFiles(x86)%\remotepc host\is-fcdm3.tmp
%ProgramFiles(x86)%\remotepc host\is-6iuo7.tmp
%ProgramFiles(x86)%\remotepc host\is-km1bn.tmp
%ProgramFiles(x86)%\remotepc host\is-mdqu5.tmp
%APPDATA%\microsoft\windows\start menu\programs\remotepc host\remotepc host.lnk
%ProgramFiles(x86)%\remotepc\easyload32.dll
%APPDATA%\microsoft\windows\start menu\programs\remotepc host\uninstall remotepc host.lnk
%ProgramFiles(x86)%\remotepc host\easyhook64.dll
%ProgramFiles(x86)%\remotepc\easyhook64.dll
%ProgramFiles(x86)%\remotepc host\easyhook32.dll
%ProgramFiles(x86)%\remotepc\easyhook32.dll
%ALLUSERSPROFILE%\remotepc host\rpcpreuninstall.log
%APPDATA%\remotepc\rpcapplauncherlogfile.txt
%ALLUSERSPROFILE%\remotepc host\rpcdownloaderlogfile.txt
%ALLUSERSPROFILE%\remotepc host\rpcprinterdownloader.txt
<SYSTEM32>\rpcprinterdownloader.txt
%ProgramFiles(x86)%\remotepc host\rpcsuitelaunch.txt
%ProgramFiles(x86)%\remotepc host\path.ini
%WINDIR%\syswow64\remotepcservice.txt
%ALLUSERSPROFILE%\remotepc host\rpccertificate.log
%ProgramFiles(x86)%\remotepc host\rpccertificate.log
%ProgramFiles(x86)%\remotepc host\unins000.dat
%ProgramFiles(x86)%\remotepc host\unins000.msg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\remotepc host.lnk
%ProgramFiles(x86)%\remotepc host\easyload32.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\nvidiadeclib.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\nvidiaencoder.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\easyhook64.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\microsoft.windowsapicodepack.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\microsoft.windowsapicodepack.shell.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\emoji.wpf.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\communications.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferserver.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferclient.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\chat.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\libx264-164.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\swscale-6.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\swresample-4.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avutil-57.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avformat-59.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\avcodec-59.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\p2p-win.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\mp4recorddll.dll
%WINDIR%\temp\nsx89d8.tmp\system.dll
%WINDIR%\temp\~df5dd5e0a039add6df.tmp
<SYSTEM32>\spool\drivers\x64\3\remotepcscpdfprn.bpd
%WINDIR%\installer\{aa4b39d8-f8d7-43d2-9797-4e887760e360}\rpc.ico
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\newtonsoft.json.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ninja.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\es-es\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\es-es\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\de-de\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\de-de\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\en\transferclient.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4nets.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4net.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferserver.exe.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\communications.dll.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ja-jp\chat.resources.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\chat.exe.config
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\log4net.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\typography.openfont.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\typography.glyphlayout.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.valuetuple.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.threading.tasks.dataflow.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\system.net.websockets.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\shellicons.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.ntf
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.hlp
<SYSTEM32>\spool\drivers\x64\3\new\remotepcscpdfprn.ppd
%ProgramFiles%\remotepcprinter\remotepcmon.dll
%ProgramFiles%\remotepcprinter\pstopdfconsole.exe
%ProgramFiles%\remotepcprinter\gsdll64.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe
%WINDIR%\temp\~df9913ba30c35a4701.tmp
%ALLUSERSPROFILE%\remotepc performance host\logs\plugininstaller.log
%ProgramFiles(x86)%\remotepc host\remotepcperformance\uninst.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformance.url
%ALLUSERSPROFILE%\remotepc performance host\logs\rpcperformanceservice.log
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\rpcaccessnotifier.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\aw_sas32.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\rpcutility.exe
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\ja.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\es.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\resources\de.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\networkhandler.dll
%ProgramFiles%\remotepcprinter\remotepcprinter.exe.config
%ProgramFiles%\remotepcprinter\remotepcprinter.pdb
%ProgramFiles%\remotepcprinter\remotepcprinter.exe
%ProgramFiles%\remotepcprinter\remotepcprintercore.dll
<SYSTEM32>\spool\drivers\x64\3\new\remotepcps5ui.dll
%ProgramFiles%\remotepcprinter\remotepcprintercore.pdb
<SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript5.dll
<SYSTEM32>\spool\drivers\x64\remotepcpscript.ntf
<SYSTEM32>\spool\drivers\x64\remotepcscpdfprn.ppd
<SYSTEM32>\spool\drivers\x64\remotepcpscript.hlp
<SYSTEM32>\spool\drivers\x64\remotepcps5ui.dll
<SYSTEM32>\spool\drivers\x64\remotepcpscript5.dll
<SYSTEM32>\gsdll64.dll
%WINDIR%\installer\msi5459.tmp-\customaction.config
%ProgramFiles(x86)%\remotepc host\fr\is-mp042.tmp
%WINDIR%\installer\msi5459.tmp-\remotepcprintercore.dll
%WINDIR%\installer\msi5459.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprinterinstallcustomaction.dll
%ProgramFiles%\remotepcprinter\remotepcscpdfprn.ppd
%ProgramFiles%\remotepcprinter\remotepcpscript5.dll
%ProgramFiles%\remotepcprinter\remotepcpscript.ntf
%ProgramFiles%\remotepcprinter\remotepcpscript.hlp
%ProgramFiles%\remotepcprinter\remotepcps5ui.dll
<SYSTEM32>\remotepcmon.dll
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\transferclient.exe.config
%ProgramFiles(x86)%\remotepc host\fr\is-456sc.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-m9r5i.tmp
%ProgramFiles(x86)%\remotepc host\is-rft5m.tmp
%ProgramFiles(x86)%\remotepc host\is-t8mc0.tmp
%ALLUSERSPROFILE%\remotepc host\is-sv4o4.tmp
%ALLUSERSPROFILE%\remotepc host\is-b3i4c.tmp
%ALLUSERSPROFILE%\remotepc host\is-6t23m.tmp
%ALLUSERSPROFILE%\remotepc host\is-rafaj.tmp
%ALLUSERSPROFILE%\remotepc host\is-njrar.tmp
%ProgramFiles(x86)%\remotepc host\is-0hdbu.tmp
%ProgramFiles(x86)%\remotepc host\is-2vig6.tmp
%ProgramFiles(x86)%\remotepc host\is-gn98t.tmp
%ProgramFiles(x86)%\remotepc host\is-6ke0m.tmp
%ProgramFiles(x86)%\remotepc host\is-qd5na.tmp
%ProgramFiles(x86)%\remotepc host\is-o1ddf.tmp
%ProgramFiles(x86)%\remotepc host\is-1plk5.tmp
%ProgramFiles(x86)%\remotepc host\is-aeulu.tmp
%ProgramFiles(x86)%\remotepc host\is-hbd5o.tmp
%ProgramFiles(x86)%\remotepc host\is-ua81o.tmp
%ProgramFiles(x86)%\remotepc host\is-b7gld.tmp
%ProgramFiles(x86)%\remotepc host\is-0iqjr.tmp
%ProgramFiles(x86)%\remotepc host\is-jp3jo.tmp
%ProgramFiles(x86)%\remotepc host\is-1r8nv.tmp
%ProgramFiles(x86)%\remotepc host\is-b0a9g.tmp
%ProgramFiles(x86)%\remotepc host\is-bt1in.tmp
%ProgramFiles(x86)%\remotepc host\is-gugmq.tmp
%ProgramFiles(x86)%\remotepc host\is-ce64s.tmp
%ProgramFiles(x86)%\remotepc host\is-itpab.tmp
%ProgramFiles(x86)%\remotepc host\is-vl4ts.tmp
%ProgramFiles(x86)%\remotepc host\is-jjb1k.tmp
%ProgramFiles(x86)%\remotepc host\is-k5j3k.tmp
%ProgramFiles(x86)%\remotepc host\is-lrung.tmp
%ProgramFiles(x86)%\remotepc host\is-6te8a.tmp
%ProgramFiles(x86)%\remotepc host\is-3ujlu.tmp
%ProgramFiles(x86)%\remotepc host\is-amjka.tmp
%ProgramFiles(x86)%\remotepc host\is-r2qo7.tmp
%ProgramFiles(x86)%\remotepc host\is-ivs08.tmp
%ProgramFiles(x86)%\remotepc host\is-8urst.tmp
%ProgramFiles(x86)%\remotepc host\is-dafv3.tmp
%ProgramFiles(x86)%\remotepc host\is-96q7p.tmp
%ProgramFiles(x86)%\remotepc host\is-datdk.tmp
%ProgramFiles(x86)%\remotepc host\is-9mhg9.tmp
%ProgramFiles(x86)%\remotepc host\is-c6qar.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ko0kr.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qgh6k.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-qipa3.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-vah97.tmp
%ProgramFiles(x86)%\remotepc host\is-vcoug.tmp
%ProgramFiles(x86)%\remotepc host\is-0vgg0.tmp
%ProgramFiles(x86)%\remotepc host\is-0nvm5.tmp
%ProgramFiles(x86)%\remotepc host\is-grnml.tmp
%ProgramFiles(x86)%\remotepc host\is-08omj.tmp
%ProgramFiles(x86)%\remotepc host\is-dh3b1.tmp
%ProgramFiles(x86)%\remotepc host\is-60b2i.tmp
%ALLUSERSPROFILE%\remotepc host\rpcsettings.ini
%TEMP%\is-nsq7a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nsq7a.tmp\_isetup\_setup64.tmp
%TEMP%\is-jodm6.tmp\remotepchost1.tmp
%TEMP%\is-cnhrv.tmp\remotepchost1.exe
%TEMP%\is-cnhrv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cnhrv.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-sbvek.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m8gb3.tmp
%ProgramFiles(x86)%\remotepc host\is-u0vna.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-ovnel.tmp
%ProgramFiles(x86)%\remotepc host\is-ajbah.tmp
%ProgramFiles(x86)%\remotepc host\is-9kr3k.tmp
%ProgramFiles(x86)%\remotepc host\is-lfmcs.tmp
%ProgramFiles(x86)%\remotepc host\is-lebsc.tmp
%ProgramFiles(x86)%\remotepc host\is-rnlk4.tmp
%ProgramFiles(x86)%\remotepc host\is-oga8h.tmp
%ProgramFiles(x86)%\remotepc host\is-68f82.tmp
%ProgramFiles(x86)%\remotepc host\is-pgg37.tmp
%ProgramFiles(x86)%\remotepc host\is-v387n.tmp
%ProgramFiles(x86)%\remotepc host\is-9h25r.tmp
%ProgramFiles(x86)%\remotepc host\is-ohpbb.tmp
%ProgramFiles(x86)%\remotepc host\is-dfe23.tmp
%ProgramFiles(x86)%\remotepc host\is-hvemf.tmp
%ProgramFiles(x86)%\remotepc host\is-rqgbq.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-k3lpu.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-m2nj6.tmp
%ProgramFiles(x86)%\remotepc host\bhostdriver\is-v7u5m.tmp
%ProgramFiles(x86)%\remotepc host\is-q0uah.tmp
%ProgramFiles(x86)%\remotepc host\is-bvf06.tmp
%ProgramFiles(x86)%\remotepc host\is-skfsi.tmp
%ProgramFiles(x86)%\remotepc host\is-ge41o.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-0o94r.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-uebsu.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-l2206.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-29i33.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-p7gtn.tmp
%ProgramFiles(x86)%\remotepc host\ko\is-5ktig.tmp
%ProgramFiles(x86)%\remotepc host\it\is-jnk94.tmp
%ProgramFiles(x86)%\remotepc host\it\is-j8h0m.tmp
%ProgramFiles(x86)%\remotepc host\it\is-b1q08.tmp
%ProgramFiles(x86)%\remotepc host\it\is-aen0d.tmp
%ProgramFiles(x86)%\remotepc host\it\is-oemd9.tmp
%ProgramFiles(x86)%\remotepc host\it\is-hi6jn.tmp
%ProgramFiles(x86)%\remotepc host\en\is-87bgl.tmp
%ProgramFiles(x86)%\remotepc host\es\is-3budt.tmp
%ProgramFiles(x86)%\remotepc host\es\is-7vkr0.tmp
%ProgramFiles(x86)%\remotepc host\es\is-3kq5f.tmp
%ProgramFiles(x86)%\remotepc host\es\is-1hbn7.tmp
%ProgramFiles(x86)%\remotepc host\es\is-5mo4f.tmp
%ProgramFiles(x86)%\remotepc host\es\is-046m7.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-l7u5n.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-odt8a.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-pc2sb.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-5clo7.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-79lhr.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-dsa57.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-rfpoo.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-7q04t.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-pv6s6.tmp
%ProgramFiles(x86)%\remotepc host\pt-br\is-j5s6a.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-gg2hm.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-57964.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-n4pmi.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-aomqi.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-1pgj1.tmp
%ProgramFiles(x86)%\remotepc host\pt\is-9pa1p.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-b8rr5.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-51r79.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-frolc.tmp
%ProgramFiles(x86)%\remotepc host\nl\is-g8ece.tmp
%ProgramFiles(x86)%\remotepc host\es\is-ahoj5.tmp
%ProgramFiles(x86)%\remotepc host\es\is-os205.tmp
%ProgramFiles(x86)%\remotepc host\es\is-8598j.tmp
%ProgramFiles(x86)%\remotepc host\is-9ieoi.tmp
%ProgramFiles(x86)%\remotepc host\printer\is-mjll4.tmp
%ProgramFiles(x86)%\remotepc host\printer\is-1742m.tmp
%ProgramFiles(x86)%\remotepc host\is-dvsel.tmp
%ProgramFiles(x86)%\remotepc host\is-k9jcg.tmp
%ProgramFiles(x86)%\remotepc host\is-n6ndn.tmp
%ProgramFiles(x86)%\remotepc host\is-aphd0.tmp
%ProgramFiles(x86)%\remotepc host\is-5583n.tmp
%ProgramFiles(x86)%\remotepc host\is-nqskg.tmp
%ProgramFiles(x86)%\remotepc host\is-5vmqa.tmp
%ProgramFiles(x86)%\remotepc host\is-f2cuh.tmp
%ProgramFiles(x86)%\remotepc host\is-dl8td.tmp
%ProgramFiles(x86)%\remotepc host\is-pvhjr.tmp
%ProgramFiles(x86)%\remotepc host\is-h9jl6.tmp
%ProgramFiles(x86)%\remotepc host\is-me1sg.tmp
%ProgramFiles(x86)%\remotepc host\is-gvvg0.tmp
%ProgramFiles(x86)%\remotepc host\is-a43ea.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-ka1qa.tmp
%ProgramFiles(x86)%\remotepc host\is-crqdv.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-u8o9e.tmp
%ProgramFiles(x86)%\remotepc host\es\is-sgmvu.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-929le.tmp
%ProgramFiles(x86)%\remotepc host\de\is-ksue2.tmp
%ProgramFiles(x86)%\remotepc host\de\is-nporn.tmp
%ProgramFiles(x86)%\remotepc host\de\is-6n08a.tmp
%ProgramFiles(x86)%\remotepc host\de\is-n887m.tmp
%ProgramFiles(x86)%\remotepc host\de\is-1p1rd.tmp
%ProgramFiles(x86)%\remotepc host\de\is-2uvu6.tmp
%ProgramFiles(x86)%\remotepc host\de\is-340cj.tmp
%ProgramFiles(x86)%\remotepc host\de\is-m0ske.tmp
%ProgramFiles(x86)%\remotepc host\fr\is-m3819.tmp
%ProgramFiles(x86)%\remotepc host\de\is-andvq.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-bnj0n.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-ep9ov.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-edm6f.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-1k2sq.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-20g3u.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-86ab0.tmp
%ProgramFiles(x86)%\remotepc host\ja\is-1adil.tmp
%ProgramFiles(x86)%\remotepc host\de\is-l4kpu.tmp
%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcapp\tools\ja-jp\transferclient.resources.dll

Deletes the following files

%ProgramFiles(x86)%\remotepc host\pthreadgc2.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprinterinstallcustomaction.dll
%WINDIR%\installer\msi5459.tmp-\remotepcprintercore.dll
%WINDIR%\installer\msi5459.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi5459.tmp-\customaction.config
%TEMP%\is-4vd1u.tmp\<File name>.tmp
%TEMP%\is-cnhrv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cnhrv.tmp\_isetup\_setup64.tmp
%WINDIR%\temp\nsx89d8.tmp\system.dll
%TEMP%\is-cnhrv.tmp\remotepchost1.exe
%TEMP%\is-nsq7a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nsq7a.tmp\_isetup\_setup64.tmp
%ALLUSERSPROFILE%\remotepc host\easyhook.dll
%ALLUSERSPROFILE%\remotepc host\easyload64.dll
%ALLUSERSPROFILE%\remotepc host\easyload32.dll
%ALLUSERSPROFILE%\remotepc host\easyhook64.dll
%ALLUSERSPROFILE%\remotepc host\easyhook32.dll
%TEMP%\is-jodm6.tmp\remotepchost1.tmp
%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe

Moves the following files

from %ProgramFiles(x86)%\remotepc host\is-60b2i.tmp to %ProgramFiles(x86)%\remotepc host\unins000.exe
from %ProgramFiles(x86)%\remotepc host\es\is-ahoj5.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-5mo4f.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-046m7.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcftviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-1hbn7.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-3kq5f.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcutilityviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-7vkr0.tmp to %ProgramFiles(x86)%\remotepc host\es\rpcvieweruiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-3budt.tmp to %ProgramFiles(x86)%\remotepc host\es\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\en\is-87bgl.tmp to %ProgramFiles(x86)%\remotepc host\en\rpcsuite.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-hi6jn.tmp to %ProgramFiles(x86)%\remotepc host\it\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-oemd9.tmp to %ProgramFiles(x86)%\remotepc host\it\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-aen0d.tmp to %ProgramFiles(x86)%\remotepc host\it\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-b1q08.tmp to %ProgramFiles(x86)%\remotepc host\it\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-j8h0m.tmp to %ProgramFiles(x86)%\remotepc host\it\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\it\is-jnk94.tmp to %ProgramFiles(x86)%\remotepc host\it\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-5ktig.tmp to %ProgramFiles(x86)%\remotepc host\ko\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-p7gtn.tmp to %ProgramFiles(x86)%\remotepc host\ko\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-29i33.tmp to %ProgramFiles(x86)%\remotepc host\ko\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-l2206.tmp to %ProgramFiles(x86)%\remotepc host\ko\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-uebsu.tmp to %ProgramFiles(x86)%\remotepc host\ko\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-os205.tmp to %ProgramFiles(x86)%\remotepc host\es\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\ko\is-0o94r.tmp to %ProgramFiles(x86)%\remotepc host\ko\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-8598j.tmp to %ProgramFiles(x86)%\remotepc host\es\remotepclauncher.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-ksue2.tmp to %ProgramFiles(x86)%\remotepc host\de\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-ka1qa.tmp to %ProgramFiles(x86)%\remotepc host\ja\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-u8o9e.tmp to %ProgramFiles(x86)%\remotepc host\ja\remotepclauncher.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-929le.tmp to %ProgramFiles(x86)%\remotepc host\ja\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-1adil.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-86ab0.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-20g3u.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcftviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-1k2sq.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-edm6f.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcutilityviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-ep9ov.tmp to %ProgramFiles(x86)%\remotepc host\ja\rpcvieweruiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\ja\is-bnj0n.tmp to %ProgramFiles(x86)%\remotepc host\ja\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-andvq.tmp to %ProgramFiles(x86)%\remotepc host\de\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-m0ske.tmp to %ProgramFiles(x86)%\remotepc host\de\remotepclauncher.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-l4kpu.tmp to %ProgramFiles(x86)%\remotepc host\de\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-340cj.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-2uvu6.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-1p1rd.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcftviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-n887m.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-6n08a.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcutilityviewer.resources.dll
from %ProgramFiles(x86)%\remotepc host\de\is-nporn.tmp to %ProgramFiles(x86)%\remotepc host\de\rpcvieweruiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\es\is-sgmvu.tmp to %ProgramFiles(x86)%\remotepc host\es\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-l7u5n.tmp to %ProgramFiles(x86)%\remotepc host\nl\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-odt8a.tmp to %ProgramFiles(x86)%\remotepc host\nl\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-g8ece.tmp to %ProgramFiles(x86)%\remotepc host\nl\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\is-r4gco.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_ko_ko.dll
from %ProgramFiles(x86)%\remotepc host\is-jj68e.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_nl_nl.dll
from %ProgramFiles(x86)%\remotepc host\is-7g0u5.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_pt_br.dll
from %ProgramFiles(x86)%\remotepc host\is-nkh2t.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_fr_fr.dll
from %ProgramFiles(x86)%\remotepc host\is-egvk0.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_it_it.dll
from %ProgramFiles(x86)%\remotepc host\is-au57l.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_pt_pt.dll
from %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-a0q19.tmp to %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\devcon.exe
from %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-uh5li.tmp to %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.cat
from <SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.hlp to <SYSTEM32>\spool\drivers\x64\3\remotepcpscript.hlp
from %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-ueq06.tmp to %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.inf
from %TEMP%\is-e5r07.tmp to %TEMP%\addtrust external ca root.cer
from %TEMP%\is-ehc3b.tmp to %TEMP%\user_t_auth.cer
from %ALLUSERSPROFILE%\remotepc host\is-r6243.tmp to %ALLUSERSPROFILE%\remotepc host\hostdesc.ini
from %ProgramFiles(x86)%\remotepc host\is-mdqu5.tmp to %ProgramFiles(x86)%\remotepc host\unzip32.dll
from %ProgramFiles(x86)%\remotepc host\is-fkkfo.tmp to %ProgramFiles(x86)%\remotepc host\zip32.dll
from <SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript5.dll to <SYSTEM32>\spool\drivers\x64\3\remotepcpscript5.dll
from <SYSTEM32>\spool\drivers\x64\3\new\remotepcps5ui.dll to <SYSTEM32>\spool\drivers\x64\3\remotepcps5ui.dll
from <SYSTEM32>\spool\drivers\x64\3\new\remotepcscpdfprn.ppd to <SYSTEM32>\spool\drivers\x64\3\remotepcscpdfprn.ppd
from %ProgramFiles(x86)%\remotepc host\is-fcdm3.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_en_en.dll
from %ProgramFiles(x86)%\remotepc host\is-mvc7l.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_jp_jp.dll
from %ProgramFiles(x86)%\remotepc host\is-6iuo7.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_es_es.dll
from %ProgramFiles(x86)%\remotepc host\is-km1bn.tmp to %ProgramFiles(x86)%\remotepc host\rpccoreviewer_de_de.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-mp042.tmp to %ProgramFiles(x86)%\remotepc host\fr\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-51r79.tmp to %ProgramFiles(x86)%\remotepc host\nl\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-b8rr5.tmp to %ProgramFiles(x86)%\remotepc host\nl\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-9pa1p.tmp to %ProgramFiles(x86)%\remotepc host\pt\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-1pgj1.tmp to %ProgramFiles(x86)%\remotepc host\pt\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-aomqi.tmp to %ProgramFiles(x86)%\remotepc host\pt\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-n4pmi.tmp to %ProgramFiles(x86)%\remotepc host\pt\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-gg2hm.tmp to %ProgramFiles(x86)%\remotepc host\pt\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt\is-m9r5i.tmp to %ProgramFiles(x86)%\remotepc host\pt\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\is-a43ea.tmp to %ProgramFiles(x86)%\remotepc host\unregister.reg
from %ProgramFiles(x86)%\remotepc host\pt-br\is-pv6s6.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt-br\is-j5s6a.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt-br\is-rfpoo.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt-br\is-dsa57.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt-br\is-79lhr.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\viewerhostkeypopup.resources.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-5clo7.tmp to %ProgramFiles(x86)%\remotepc host\fr\remotepchostui.resources.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-pc2sb.tmp to %ProgramFiles(x86)%\remotepc host\fr\remotepcuiu.resources.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-57964.tmp to %ProgramFiles(x86)%\remotepc host\fr\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-m3819.tmp to %ProgramFiles(x86)%\remotepc host\fr\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\fr\is-456sc.tmp to %ProgramFiles(x86)%\remotepc host\fr\rpcutilityhost.resources.dll
from %ProgramFiles(x86)%\remotepc host\nl\is-frolc.tmp to %ProgramFiles(x86)%\remotepc host\nl\rpcfthost.resources.dll
from %ProgramFiles(x86)%\remotepc host\pt-br\is-7q04t.tmp to %ProgramFiles(x86)%\remotepc host\pt-br\rpcdownloader.resources.dll
from %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\is-gbafl.tmp to %ProgramFiles(x86)%\remotepc host\virtualaudiodriver\remotepcvad.sys
from %ProgramFiles(x86)%\remotepc host\is-crqdv.tmp to %ProgramFiles(x86)%\remotepc host\register.reg
from %ProgramFiles(x86)%\remotepc host\is-f2cuh.tmp to %ProgramFiles(x86)%\remotepc host\arial.ttf
from %ProgramFiles(x86)%\remotepc host\is-68f82.tmp to %ProgramFiles(x86)%\remotepc host\rpcfthost.exe
from %ProgramFiles(x86)%\remotepc host\is-oga8h.tmp to %ProgramFiles(x86)%\remotepc host\rpcproxylatency.exe
from %ProgramFiles(x86)%\remotepc host\is-rnlk4.tmp to %ProgramFiles(x86)%\remotepc host\preuninstall.exe
from %ProgramFiles(x86)%\remotepc host\is-lebsc.tmp to %ProgramFiles(x86)%\remotepc host\remotepcdesktop.exe
from %ProgramFiles(x86)%\remotepc host\is-lfmcs.tmp to %ProgramFiles(x86)%\remotepc host\remotepcservice.exe
from %ProgramFiles(x86)%\remotepc host\is-9kr3k.tmp to %ProgramFiles(x86)%\remotepc host\rpcgae.exe
from %ProgramFiles(x86)%\remotepc host\is-ajbah.tmp to %ProgramFiles(x86)%\remotepc host\rpcclipboard.exe
from %ProgramFiles(x86)%\remotepc host\is-u0vna.tmp to %ProgramFiles(x86)%\remotepc host\rpcdownloader.exe
from %ProgramFiles(x86)%\remotepc host\is-q0uah.tmp to %ProgramFiles(x86)%\remotepc host\servicemonitor.exe
from %ProgramFiles(x86)%\remotepc host\is-c6qar.tmp to %ProgramFiles(x86)%\remotepc host\rpcprintuninstall.exe
from %ProgramFiles(x86)%\remotepc host\is-datdk.tmp to %ProgramFiles(x86)%\remotepc host\viewerhostkeypopup.exe
from %ProgramFiles(x86)%\remotepc host\is-ua81o.tmp to %ProgramFiles(x86)%\remotepc host\dragdrop-console.exe
from %ProgramFiles(x86)%\remotepc host\is-hbd5o.tmp to %ProgramFiles(x86)%\remotepc host\easyhook32svc.exe
from %ProgramFiles(x86)%\remotepc host\is-aeulu.tmp to %ProgramFiles(x86)%\remotepc host\easyhook64svc.exe
from %ProgramFiles(x86)%\remotepc host\is-1plk5.tmp to %ProgramFiles(x86)%\remotepc host\rpcprinterdownloader.exe
from %ProgramFiles(x86)%\remotepc host\is-o1ddf.tmp to %ProgramFiles(x86)%\remotepc host\rpcdnd_console.exe
from %ProgramFiles(x86)%\remotepc host\is-qd5na.tmp to %ProgramFiles(x86)%\remotepc host\rpcdndlibrary.dll
from %ProgramFiles(x86)%\remotepc host\is-6ke0m.tmp to %ProgramFiles(x86)%\remotepc host\rpcutilityhost.exe
from %ProgramFiles(x86)%\remotepc host\is-gn98t.tmp to %ProgramFiles(x86)%\remotepc host\rpcutilityviewer.exe
from %ProgramFiles(x86)%\remotepc host\is-pgg37.tmp to %ProgramFiles(x86)%\remotepc host\remotepchostui.exe
from %ProgramFiles(x86)%\remotepc host\is-2vig6.tmp to %ProgramFiles(x86)%\remotepc host\dragdrop-dll_x32.dll
from %ProgramFiles(x86)%\remotepc host\is-v387n.tmp to %ProgramFiles(x86)%\remotepc host\remotepcuiu.exe
from %ProgramFiles(x86)%\remotepc host\is-ohpbb.tmp to %ProgramFiles(x86)%\remotepc host\system.windows.interactivity.dll
from %ProgramFiles(x86)%\remotepc host\is-dh3b1.tmp to %ProgramFiles(x86)%\remotepc host\suitelauncher.exe
from %ProgramFiles(x86)%\remotepc host\is-08omj.tmp to %ProgramFiles(x86)%\remotepc host\remotepclauncher.exe
from %ProgramFiles(x86)%\remotepc host\is-grnml.tmp to %ProgramFiles(x86)%\remotepc host\remotepcblackscreenapp.exe
from %ProgramFiles(x86)%\remotepc host\is-0nvm5.tmp to %ProgramFiles(x86)%\remotepc host\remotepcdrivercontrollerapi.dll
from %ProgramFiles(x86)%\remotepc host\is-0vgg0.tmp to %ProgramFiles(x86)%\remotepc host\ccdwrapper.dll
from %ProgramFiles(x86)%\remotepc host\is-vcoug.tmp to %ProgramFiles(x86)%\remotepc host\devcon.exe
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-vah97.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriver.cat
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-qipa3.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriver.inf
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-qgh6k.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriverumode1_0.dll
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-sbvek.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcddriverumode1_2.dll
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-ko0kr.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.cat
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-m8gb3.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.inf
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-ovnel.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcude.sys
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-v7u5m.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.cat
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-m2nj6.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.inf
from %ProgramFiles(x86)%\remotepc host\bhostdriver\is-k3lpu.tmp to %ProgramFiles(x86)%\remotepc host\bhostdriver\remotepcudehost.sys
from %ProgramFiles(x86)%\remotepc host\is-rqgbq.tmp to %ProgramFiles(x86)%\remotepc host\galasoft.mvvmlight.dll
from %ProgramFiles(x86)%\remotepc host\is-hvemf.tmp to %ProgramFiles(x86)%\remotepc host\galasoft.mvvmlight.extras.dll
from %ProgramFiles(x86)%\remotepc host\is-dfe23.tmp to %ProgramFiles(x86)%\remotepc host\microsoft.practices.servicelocation.dll
from %ProgramFiles(x86)%\remotepc host\is-9h25r.tmp to %ProgramFiles(x86)%\remotepc host\wpfanimatedgif.dll
from %ProgramFiles(x86)%\remotepc host\is-0hdbu.tmp to %ProgramFiles(x86)%\remotepc host\dragdrop-dll_x64.dll
from %ALLUSERSPROFILE%\remotepc host\is-njrar.tmp to %ALLUSERSPROFILE%\remotepc host\easyhook32.dll
from %ALLUSERSPROFILE%\remotepc host\is-rafaj.tmp to %ALLUSERSPROFILE%\remotepc host\easyhook64.dll
from %ProgramFiles(x86)%\remotepc host\is-b0a9g.tmp to %ProgramFiles(x86)%\remotepc host\libwinpthread-1.dll
from %ProgramFiles(x86)%\remotepc host\is-jp3jo.tmp to %ProgramFiles(x86)%\remotepc host\sdl.dll
from %ProgramFiles(x86)%\remotepc host\is-bvf06.tmp to %ProgramFiles(x86)%\remotepc host\swresample-3.dll
from %ProgramFiles(x86)%\remotepc host\is-skfsi.tmp to %ProgramFiles(x86)%\remotepc host\swscale-5.dll
from %ProgramFiles(x86)%\remotepc host\is-ge41o.tmp to %ProgramFiles(x86)%\remotepc host\rpcfirewall.exe
from %ProgramFiles(x86)%\remotepc host\is-me1sg.tmp to %ProgramFiles(x86)%\remotepc host\ssleay32.dll
from %ProgramFiles(x86)%\remotepc host\is-h9jl6.tmp to %ProgramFiles(x86)%\remotepc host\newtonsoft.json.dll
from %ProgramFiles(x86)%\remotepc host\is-pvhjr.tmp to %ProgramFiles(x86)%\remotepc host\madxlib.dll
from %ProgramFiles(x86)%\remotepc host\printer\is-mjll4.tmp to %ProgramFiles(x86)%\remotepc host\printer\rpcprintinstall.exe
from %ProgramFiles(x86)%\remotepc host\is-dl8td.tmp to %ProgramFiles(x86)%\remotepc host\dotnetfx45_full_setup.exe
from %ProgramFiles(x86)%\remotepc host\is-5vmqa.tmp to %ProgramFiles(x86)%\remotepc host\rootcert.pem
from %ProgramFiles(x86)%\remotepc host\is-nqskg.tmp to %ProgramFiles(x86)%\remotepc host\swresample-2.dll
from %ProgramFiles(x86)%\remotepc host\is-5583n.tmp to %ProgramFiles(x86)%\remotepc host\msvcr90.dll
from %ProgramFiles(x86)%\remotepc host\is-aphd0.tmp to %ProgramFiles(x86)%\remotepc host\microsoft.vc90.crt.manifest
from %ProgramFiles(x86)%\remotepc host\is-n6ndn.tmp to %ProgramFiles(x86)%\remotepc host\lame_enc.dll
from %ProgramFiles(x86)%\remotepc host\is-k9jcg.tmp to %ProgramFiles(x86)%\remotepc host\rpduilaunch.exe
from %ProgramFiles(x86)%\remotepc host\is-dvsel.tmp to %ProgramFiles(x86)%\remotepc host\microsoft.win32.taskscheduler.dll
from %ProgramFiles(x86)%\remotepc host\printer\is-1742m.tmp to %ProgramFiles(x86)%\remotepc host\printer\remotepcprintercore.dll
from %ProgramFiles(x86)%\remotepc host\is-gugmq.tmp to %ProgramFiles(x86)%\remotepc host\avformat-58.dll
from %ProgramFiles(x86)%\remotepc host\is-bt1in.tmp to %ProgramFiles(x86)%\remotepc host\libgcc_s_sjlj-1.dll
from %ProgramFiles(x86)%\remotepc host\is-ce64s.tmp to %ProgramFiles(x86)%\remotepc host\avutil-56.dll
from %ProgramFiles(x86)%\remotepc host\is-itpab.tmp to %ProgramFiles(x86)%\remotepc host\sas.dll
from %ProgramFiles(x86)%\remotepc host\is-vl4ts.tmp to %ProgramFiles(x86)%\remotepc host\websocket-sharp.dll
from %ALLUSERSPROFILE%\remotepc host\is-b3i4c.tmp to %ALLUSERSPROFILE%\remotepc host\easyload64.dll
from %ALLUSERSPROFILE%\remotepc host\is-sv4o4.tmp to %ALLUSERSPROFILE%\remotepc host\easyhook.dll
from %ProgramFiles(x86)%\remotepc host\is-t8mc0.tmp to %ProgramFiles(x86)%\remotepc host\resample.dll
from %ProgramFiles(x86)%\remotepc host\is-rft5m.tmp to %ProgramFiles(x86)%\remotepc host\msvcp110.dll
from %ProgramFiles(x86)%\remotepc host\is-b7gld.tmp to %ProgramFiles(x86)%\remotepc host\msvcr110.dll
from %ProgramFiles(x86)%\remotepc host\is-9mhg9.tmp to %ProgramFiles(x86)%\remotepc host\aw_sas32.dll
from %ProgramFiles(x86)%\remotepc host\is-0iqjr.tmp to %ProgramFiles(x86)%\remotepc host\vccorlib110.dll
from %ProgramFiles(x86)%\remotepc host\is-1r8nv.tmp to %ProgramFiles(x86)%\remotepc host\msvcr100.dll
from %ProgramFiles(x86)%\remotepc host\is-9ieoi.tmp to %ProgramFiles(x86)%\remotepc host\rpccredentialprovider.dll
from %ProgramFiles(x86)%\remotepc host\is-dafv3.tmp to %ProgramFiles(x86)%\remotepc host\avcodec-58.dll
from %ProgramFiles(x86)%\remotepc host\is-96q7p.tmp to %ProgramFiles(x86)%\remotepc host\libx264.dll
from %ProgramFiles(x86)%\remotepc host\is-ivs08.tmp to %ProgramFiles(x86)%\remotepc host\libeay32.dll
from %ProgramFiles(x86)%\remotepc host\is-r2qo7.tmp to %ProgramFiles(x86)%\remotepc host\d3dx9_43.dll
from %ProgramFiles(x86)%\remotepc host\is-amjka.tmp to %ProgramFiles(x86)%\remotepc host\remotepc_installer.ico
from %ProgramFiles(x86)%\remotepc host\is-3ujlu.tmp to %ProgramFiles(x86)%\remotepc host\remotepc__installer_noborder.ico
from %ProgramFiles(x86)%\remotepc host\is-6te8a.tmp to %ProgramFiles(x86)%\remotepc host\odyssey.dll
from %ProgramFiles(x86)%\remotepc host\is-lrung.tmp to %ProgramFiles(x86)%\remotepc host\cbthook.dll
from %ProgramFiles(x86)%\remotepc host\is-k5j3k.tmp to %ProgramFiles(x86)%\remotepc host\windowshook.dll
from %ProgramFiles(x86)%\remotepc host\is-jjb1k.tmp to %ProgramFiles(x86)%\remotepc host\zlib.net.dll
from %ALLUSERSPROFILE%\remotepc host\is-6t23m.tmp to %ALLUSERSPROFILE%\remotepc host\easyload32.dll
from %ProgramFiles(x86)%\remotepc host\is-8urst.tmp to %ProgramFiles(x86)%\remotepc host\pthreadgc2.dll
from <SYSTEM32>\spool\drivers\x64\3\new\remotepcpscript.ntf to <SYSTEM32>\spool\drivers\x64\3\remotepcpscript.ntf

Substitutes the following files

%ProgramFiles(x86)%\remotepc host\pthreadgc2.dll

Network activity

Connects to

'st####.remotepc.com':443
'we##.#emotepc.com':443

TCP

Other

'st####.remotepc.com':443

UDP

DNS ASK st####.remotepc.com
DNS ASK we##.#emotepc.com
DNS ASK ca#####nia.remotepc.com
DNS ASK as##.#emotepc.com

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: 'Notification Area'
ClassName: 'ToolbarWindow32' WindowName: 'User Promoted Notification Area'
ClassName: 'NotifyIconOverflowWindow' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: 'Overflow Notification Area'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Creates and executes the following

'%TEMP%\is-4vd1u.tmp\<File name>.tmp' /SL5="$14023E,20426831,209408,<Full path to file>"
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\remotepcperformanceplugins.exe' /S /D=%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePlugins.exe"
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\rpcperformanceservice.exe'
'%ALLUSERSPROFILE%\remotepc host\codec\remotepcperformance.exe' /S /HostOnly /D=%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance
'%ProgramFiles(x86)%\remotepc host\remotepchostui.exe'
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' suitelaunch
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' servicestatus
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe'
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePrinter.exe"
'%ProgramFiles(x86)%\remotepc host\preuninstall.exe' 1
'%ProgramFiles(x86)%\remotepc host\suitelauncher.exe'
'%ProgramFiles(x86)%\remotepc host\remotepcservice.exe'
'%ProgramFiles(x86)%\remotepc host\rpcprinterdownloader.exe'
'%TEMP%\is-cnhrv.tmp\remotepchost1.exe' /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=
'%ProgramFiles(x86)%\remotepc host\remotepclauncher.exe' 4
'%TEMP%\is-jodm6.tmp\remotepchost1.tmp' /SL5="$C0224,19746857,209408,%TEMP%\is-CNHRV.tmp\RemotePCHost1.exe" /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=
'%ProgramFiles(x86)%\remotepc host\rpcfirewall.exe'
'%ProgramFiles(x86)%\remotepc host\rpduilaunch.exe' 1
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc start Spooler binpath=<SYSTEM32>\spoolsv.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RPCCodecEngineHost" dir=in action=allow program="%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,p...' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start RPCService' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePlugins.exe"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' failure RPCService reset= INFINITE actions= restart/2000/restart/2000/restart/2000' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /u /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"' (with hidden window)
'%TEMP%\is-cnhrv.tmp\remotepchost1.exe' /NORESTART /DeployementID= /Groupname= /PersonalKey= /AutoUpdate= /HideTray= /ConnectPermission=' (with hidden window)
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc stop Spooler"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create RPCService start= auto binPath= "\"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe\""' (with hidden window)
'<SYSTEM32>\cmd.exe' /user:Administrator cmd /K sc create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\remotepclauncher.exe' 4' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' suitelaunch' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\preuninstall.exe' 1' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\suitelauncher.exe' ' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\rpcfirewall.exe' ' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\rpcdownloader.exe' servicestatus' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\rpduilaunch.exe' 1' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\regasm.exe' /tlb /register /codebase /nologo /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"' (with hidden window)
'%ProgramFiles(x86)%\remotepc host\remotepcperformance\plugininstaller.exe' "https://static.remotepc.com/downloads/RemotePCPerformancePrinter.exe"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\sc.exe' create RPCService start= auto binPath= "\"%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe\""
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' install "%ProgramFiles%\RemotePCPrinter\RemotePCPrinterCore.dll" /queue:1
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI5459.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1267024 15 RemotepcPrinterInstallCustomAction!PdfScribeInstallCustomAction.CustomActions.InstallPdfScribePrinter
'<SYSTEM32>\msiexec.exe' /qn /i "%ALLUSERSPROFILE%\RemotePC Host\PrinterSetup\Printer.msi"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\regasm.exe' /tlb /register /codebase /nologo /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'<SYSTEM32>\spoolsv.exe'
'<SYSTEM32>\sc.exe' start Spooler binpath=<SYSTEM32>\spoolsv.exe"
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc start Spooler binpath=<SYSTEM32>\spoolsv.exe"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /u /silent "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\NetworkHandler.dll"
'<SYSTEM32>\sc.exe' stop Spooler"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' install "%ProgramFiles%\RemotePCPrinter\RemotePCPrinter.exe" /queue:1
'%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\RemotePC Host\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
'<SYSTEM32>\msiexec.exe' /x {AA4B39D8-F8D7-43D2-9797-4E887760E360} /quiet
'<SYSTEM32>\msiexec.exe' /x {4011606E-CB2A-46D7-8A5E-7EF535C3DEA7} /quiet
'<SYSTEM32>\sc.exe' create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'<SYSTEM32>\cmd.exe' /user:Administrator cmd /K sc create RPCService start=auto binpath="%ProgramFiles(x86)%\RemotePC Host\RemotePCService.exe"
'%WINDIR%\regedit.exe' /s "%ProgramFiles(x86)%\RemotePC Host\\Register.reg"
'<SYSTEM32>\msiexec.exe' /x {609B0019-4E60-4701-B998-BFA115415694} /quiet
'<SYSTEM32>\msiexec.exe' /x {68155655-B909-4294-8A9B-D60E2CF5362F} /quiet
'<SYSTEM32>\msiexec.exe' /x {99826982-7148-412E-8CFA-D5F14F1A26C4} /quiet
'<SYSTEM32>\msiexec.exe' /x {90515785-8089-4070-975A-15F0252A9BB5} /quiet
'%WINDIR%\syswow64\sc.exe' start RPCService
'%WINDIR%\syswow64\sc.exe' failure RPCService reset= INFINITE actions= restart/2000/restart/2000/restart/2000
'<SYSTEM32>\cmd.exe' /user:Administrator "cmd /K sc stop Spooler"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' update /queue

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial