Versions
(Note, Search Safer Inc. publishes each variation of this file with the same version, but the hashes are unique.)
Relationships
service.exe
By Search Safer Inc. (Signed)
Overview
service.exe has 5 known versions, the most recent one is . It is started as a Windows Service called 'Kinoni Remote Desktop' with the name 'KinoniRemoteDesktop'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). During installation, a run registry key for all users is added that will cause the program to run each time any user logs on to Windows. The average file size is about 80.5 KB. It is an authenticode code-signed executable issued to Search Safer Inc. by the certification authority DigiCert Inc.
 Details
|
| File name: | service.exe |
| Typical file path: | C:\Program Files\pcmax\service.exe |
| Certificate |
| Issued to: | Search Safer Inc. |
| Authority (CA): | DigiCert Inc |
| Effective date: | Wednesday, May 28, 2014 |
| Expiration date: | Wednesday, February 10, 2016 |
| Windows Service |
| Service name: | KinoniRemoteDesktop |
| Display name: | Kinoni Remote Desktop |
| Description: | “Kinoni Remote Desktop” |
| Type: | Win32OwnProcess, InteractiveProcess |
Behaviors
(Note, the behaviors below are for all versions of service.exe, select a unique version for details.)
Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'pcreg' → C:\Program Files\pcmax\service.exe
Scheduled tasks
- The job 'pcreg' runs on logon in the path '\pcreg'
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- 'KinoniRemoteDesktop' (Kinoni Remote Desktop)
All file variations of service.exe
