Skip to content
remotledocsComputle Docs

Antivirus and EDR

Behaviour and network

This page is for the administrator reviewing what an endpoint product reports. Expect one DLL injected into the Start menu process, processes started in users’ sessions, synthetic input, and outbound traffic only.

Behaviour an endpoint product may report

Section titled “Behaviour an endpoint product may report”
BehaviourDetail
Remote thread into StartMenuExperienceHost.exeComputleRemotleService.exe loads ComputleShellButton.dll into the Start menu process with CreateRemoteThread, and unloads it the same way.
Debug privilegeComputleRemotleServer.exe and ComputleCaptureWorker.exe enable the debug privilege to open the driver host process WUDFHost.exe and share the virtual display’s frame buffer.
Processes started in the user’s sessionThe services start ComputleRemotleServer.exe, ComputleRemotleDisplay.exe and ComputleInputController.exe in the signed-in user’s session when a session starts.
Synthetic inputComputleInputController.exe injects keyboard and mouse input from the client.
Credential provider registrationThe installer registers ComputleCredentialProvider.dll under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{86298202-B2EE-44AE-A354-A1CE4A2E5C26}. It offers a sign-in tile only while a connection is signing someone in with Microsoft Entra ID, and handles no Windows password.
PowerShell during installThe installer runs host-setup.ps1 as SYSTEM, from a temporary folder, to install drivers (pnputil, devcon), register COM servers (regsvr32), create services, set folder permissions (icacls) and remove old firewall rules (netsh).
Display changesDuring a session the host adds virtual monitors and changes the display layout, and restores it when the session ends.
Named pipesHost processes talk to each other over named pipes with access lists that admit SYSTEM, administrators and the session server only. No host process opens a socket to listen.
Windows Error Reporting keysThe installer sets LocalDumps for each host program so a crash leaves a minidump in C:\ProgramData\Computle\CrashDumps\.
Client certificate useComputleUpdater.exe, ComputleEnrolment.exe and ComputleSessionServer.exe present the workstation’s certificate from C:\ProgramData\Computle\Broker\ when they connect to Computle. The certificate is renewed every 20 days with a fresh key, held in the TPM where the workstation has one.

Network

Section titled “Network”

The host makes outbound connections only, over TCP 443 and UDP. The installer adds no inbound firewall rules and removes any left by an earlier version. No host process listens on any port, loopback included, and the host uses no UPnP.

ProcessConnects to
ComputleSessionServer.exeThe connection service (TCP 443), relays in London, New York and Canada (UDP 4443), STUN (UDP 3478), and the user’s device directly (UDP)
ComputleUpdater.exeupdates.computle.com, the three witness domains and the download storage (TCP 443)
ComputleEnrolment.exeThe certificate authority and identity service (TCP 443)
ComputleRemotleService.exekeygen.computle.com for the licence check, and the log service (TCP 443)

The session itself is one QUIC connection, TLS 1.3 only, carrying video, audio, input, clipboard and USB. The nearest relay is used when no direct path exists; a relay forwards encrypted traffic and cannot decrypt it. The domains are listed on Network Requirements.
Section titled “Related”

Questions

Section titled “Questions”

What does the host do with the debug privilege?

Section titled “What does the host do with the debug privilege?”

It opens the driver host process to share the virtual display’s frame buffer with the capture process. Nothing else.

Does the host listen on any port?

Section titled “Does the host listen on any port?”

No. No host process listens on any port, on any address, loopback included. An endpoint product that reports a listening socket from a Computle process is reporting something that is not the Remotle host.