Skip to content
Remotle Docs

Host

Antivirus and EDR

This page is for IT administrators who run antivirus or endpoint detection on workstations. It lists what the host installs and the behaviour an endpoint product may report.

Signing

Section titled “Signing”

Every host executable and DLL is signed by Computle Limited. The host updater refuses a file with any other signer. The drivers are Microsoft attestation-signed.

Folders

Section titled “Folders”
FolderContents
C:\Program Files\Computle\Remotle\bin\Executables and DLLs
C:\Program Files\Computle\Remotle\drivers\Driver packages
C:\ProgramData\Computle\Remotle\Logs, saved settings and staged updates
C:\ProgramData\Computle\Broker\The host’s certificate and trust roots
C:\ProgramData\Computle\CrashDumps\Crash dumps, readable by administrators only

Processes

Section titled “Processes”
ProcessRuns asPurpose
ComputleRemotleService.exeSYSTEM, service ComputleServiceSupervises the host
ComputleSessionServer.exeLocal Service, service ComputleSessionServerRuns each session
ComputleBroker.exeSYSTEM, service ComputleBrokerConnection to Computle
ComputleCaptureWorker.exeSYSTEM, service ComputleCaptureWorkerCapture when nobody is signed in
ComputleClockSync.exeLocal Service, service ComputleClockSyncSets the clock from the connecting device
ComputleUSBClient.exeSYSTEM, service ComputleUSBPresentPresents the client’s USB devices
ComputleUpdater.exeSYSTEM, service ComputleUpdaterHost updates
ComputleEnrolment.exeSYSTEM, service ComputleEnrolmentThe host’s identity with Computle
ComputleRemotleServer.exeThe signed-in user’s sessionScreen capture and encoding
ComputleRemotleDisplay.exeThe signed-in user’s sessionVirtual monitor layout
ComputleInputController.exeThe signed-in user’s sessionApplies keyboard, mouse and clipboard input

DLLs loaded into Windows processes

Section titled “DLLs loaded into Windows processes”
DLLLoaded byPurpose
ComputleShellButton.dllStartMenuExperienceHost.exeAdds a Computle entry to the Start menu
ComputleCredentialProvider.dllLogonUI.exeA sign-in tile for silent logon. It performs no authentication itself.
softcam.dll, ComputleMfCameraSource.dllWindows Frame ServerThe client’s camera, as a camera on the workstation
ComputleIdd.dllWUDFHost.exeThe virtual display driver

Drivers

Section titled “Drivers”
DriverClassPurpose
Computle Virtual Display Adapter (ComputleIdd)DisplayVirtual monitors
Computle Virtual HID Mouse (ComputleVhidMouse)HIDPointer input
Computle Virtual Audio (ComputleAudioDriver)MediaSpeakers and microphone for the session
Computle USB VHCI (ComputleVhci)USBThe client’s USB devices

Behaviour an endpoint product may report

Section titled “Behaviour an endpoint product may report”
BehaviourDetail
Remote thread into StartMenuExperienceHost.exeComputleRemotleService.exe loads ComputleShellButton.dll into the Start menu process with CreateRemoteThread, and unloads it the same way.
Debug privilegeComputleRemotleServer.exe and ComputleCaptureWorker.exe enable the debug privilege to open the driver host process WUDFHost.exe and share the virtual display’s frame buffer.
Processes started in the user’s sessionThe services start ComputleRemotleServer.exe, ComputleRemotleDisplay.exe and ComputleInputController.exe in the signed-in user’s session.
Synthetic inputComputleInputController.exe injects keyboard and mouse input from the client.
Credential provider registrationThe installer registers ComputleCredentialProvider.dll under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.
PowerShell during installThe installer runs host-setup.ps1 as SYSTEM to install drivers (pnputil, devcon), register COM servers (regsvr32), create services and set folder permissions (icacls).
Display changesDuring a session the host adds virtual monitors and changes the display layout.

Network

Section titled “Network”

The host makes outbound connections only, over UDP and TCP. The installer adds no inbound firewall rules and removes any left by an earlier version. See Network Requirements.