Splashtop-Splashtop Business app-Remote Computer Info

18 events across 1 channel

Event ID	Title	Channel
35000	The user SPID has renamed the remote computer.	Operational
35001	The user SPID has renamed the remote computer.	Operational
35010	The user SPID has added a note to the remote computer.	Operational
35011	The user SPID has added a note to the remote computer.	Operational
35100	The user SPID has moved the remote computer to a different group.	Operational
35101	The user SPID has moved the remote computer to a different group.	Operational
35200	The user SPID has deleted the remote computer from the team.	Operational
35201	The user SPID has deleted the remote computer from the team.	Operational
35300	The user SPID has restarted the streamer on the remote computer.	Operational
35301	The user SPID has restarted the streamer on the remote computer.	Operational
35302	The user SPID has triggered Normal Reboot on the remote computer.	Operational
35303	The user SPID has triggered Normal Reboot on the remote computer.	Operational
35304	The user SPID has triggered Safe Mode Reboot on the remote computer.	Operational
35305	The user SPID has triggered Safe Mode Reboot on the remote computer.	Operational
35400	The user SPID has disconnected a remote session on the remote computer.	Operational
35401	The user SPID has disconnected a remote session on the remote computer.	Operational
35402	The user SPID has tried to wake up the remote computer SRS_Name.	Operational
35403	The user SPID has cleared the credential for the remote computer SRS_Name.	Operational

Event ID 35000 — The user SPID has renamed the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has renamed the remote computer.

Message #

The user %1 has renamed the remote computer.

App version: %2

From: %3

To: %4

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`Previous_SRS_name` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35001 — The user SPID has renamed the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has renamed the remote computer.

Message #

The user %1 has renamed the remote computer.

App version: %2

From: %3

To: %4

Error code: %5

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`Previous_SRS_name` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35010 — The user SPID has added a note to the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has added a note to the remote computer.

Message #

The user %1 has added a note to the remote computer.

App version: %2

Computer name: %3

Note: %4

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Note_contents` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35011 — The user SPID has added a note to the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has added a note to the remote computer.

Message #

The user %1 has added a note to the remote computer.

App version: %2

Computer name: %3

Note: %4

Error code: %5

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Note_contents` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35100 — The user SPID has moved the remote computer to a different group.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has moved the remote computer to a different group.

Message #

The user %1 has moved the remote computer to a different group.

App version: %2

Computer name: %3

From: %4

To: %5

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Previous_Group` UnicodeString	—
`Group` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35101 — The user SPID has moved the remote computer to a different group.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has moved the remote computer to a different group.

Message #

The user %1 has moved the remote computer to a different group.

App version: %2

Computer name: %3

From: %4

To: %5

Error code: %6

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Previous_Group` UnicodeString	—
`Group` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35200 — The user SPID has deleted the remote computer from the team.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has deleted the remote computer from the team.

Message #

The user %1 has deleted the remote computer from the team.

App version: %2

Computer name: %3

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35201 — The user SPID has deleted the remote computer from the team.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has deleted the remote computer from the team.

Message #

The user %1 has deleted the remote computer from the team.

App version: %2

Computer name: %3

Error code: %4

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35300 — The user SPID has restarted the streamer on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has restarted the streamer on the remote computer.

Message #

The user %1 has restarted the streamer on the remote computer.

App version: %2

Computer name: %3

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35301 — The user SPID has restarted the streamer on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has restarted the streamer on the remote computer.

Message #

The user %1 has restarted the streamer on the remote computer.

App version: %2

Computer name: %3

Error code: %4

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35302 — The user SPID has triggered Normal Reboot on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has triggered Normal Reboot on the remote computer.

Message #

The user %1 has triggered Normal Reboot on the remote computer.

App version: %2

Computer name: %3

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35303 — The user SPID has triggered Normal Reboot on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has triggered Normal Reboot on the remote computer.

Message #

The user %1 has triggered Normal Reboot on the remote computer.

App version: %2

Computer name: %3

Error code: %4

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35304 — The user SPID has triggered Safe Mode Reboot on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has triggered Safe Mode Reboot on the remote computer.

Message #

The user %1 has triggered Safe Mode Reboot on the remote computer.

App version: %2

Computer name: %3

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35305 — The user SPID has triggered Safe Mode Reboot on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has triggered Safe Mode Reboot on the remote computer.

Message #

The user %1 has triggered Safe Mode Reboot on the remote computer.

App version: %2

Computer name: %3

Error code: %4

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35400 — The user SPID has disconnected a remote session on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has disconnected a remote session on the remote computer.

Message #

The user %1 has disconnected a remote session on the remote computer.

App version: %2

Computer name: %3

Error code: N/A

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35401 — The user SPID has disconnected a remote session on the remote computer.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has disconnected a remote session on the remote computer.

Message #

The user %1 has disconnected a remote session on the remote computer.

App version: %2

Computer name: %3

Error code: %4

Fields #

Name	Description
`SPID` UnicodeString	—
`Version_number` UnicodeString	—
`SRS_Name` UnicodeString	—
`Error_code` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35402 — The user SPID has tried to wake up the remote computer SRS_Name.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has tried to wake up the remote computer SRS_Name.

Message #

The user %1 has tried to wake up the remote computer %2.

App version: %3

Fields #

Name	Description
`SPID` UnicodeString	—
`SRS_Name` UnicodeString	—
`Version_number` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop

Event ID 35403 — The user SPID has cleared the credential for the remote computer SRS_Name.

Provider: Splashtop-Splashtop Business app-Remote Computer Info
Channel: Operational

Description

The user SPID has cleared the credential for the remote computer SRS_Name.

Message #

The user %1 has cleared the credential for the remote computer %2.

App version: %3

Fields #

Name	Description
`SPID` UnicodeString	—
`SRS_Name` UnicodeString	—
`Version_number` UnicodeString	—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop