Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe"'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe"'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Cdrom] 'Start' = '00000001'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe' = '%ProgramFiles%\M...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe' = '%ProgramFiles%...
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe" name = "LanScope Cat MR" profile = ALL
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\mrinst_decmp_utf8.log
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_alzlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt
- nul
- %ProgramFiles%\motex\lanscope cat mr\_netsh.bat
- %TEMP%\mrinst_mr_utf8.log
- %TEMP%\mrinst_start_utf8.log
- %WINDIR%\setmr.exe
- %WINDIR%\mru.ini
- %TEMP%\mrinst_set_utf8.log
- %TEMP%\templspcat\mr.ini
- %TEMP%\templspcat\mrconf.ini
- %TEMP%\templspcat\spflog.dll
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_forbidap_mr_0000.ini
- %TEMP%\templspcat\setmr.exe
- %TEMP%\templspcat\msg
- %TEMP%\templspcat\lspweb64.dll
- %TEMP%\templspcat\lspweb.dll
- %TEMP%\templspcat\lspwaomozilla.sf
- %TEMP%\templspcat\lspwaomozilla.rsa
- %TEMP%\templspcat\lspwaomanifest.mf
- %TEMP%\templspcat\lspwaoinstall.rdf
- %TEMP%\templspcat\lspwaoie.dll
- %TEMP%\templspcat\lspwaoicon64.png
- %TEMP%\templspcat\startmr.exe
- %TEMP%\templspcat\lspmladdin2x86.msi
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_prnlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\analyzelog\20190809\lspalz_utf8_0000.txt
- %ProgramFiles%\motex\lanscope cat mr\tracelog\cdv_20190809_utf8.txt
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_lonloflog_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_devlog_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_walog_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_eventmr_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_prnlog_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_forbidap_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\uno_aptsk_mr.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_ddllog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdlrlylog_mr_0000.ini
- %TEMP%\templspcat\lspwaoicon48.png
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_aptsk_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_wualog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\ontimestamp_utf8.txt
- %ProgramFiles%\motex\lanscope cat mr\locallog\lontimestamp_utf8.txt
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_smllog_ev_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_itclog_ev_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_walog_ev_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_eventmr_ev_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_thrlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdvlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_lonloflog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_devlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_invalmlog_mr_0000.ini
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_eventmr_mr_0000.ini
- %TEMP%\templspcat\lspwaogctomr.json
- %TEMP%\templspcat\lspwaogctomr.exe
- %TEMP%\templspcat\lspwaoff.xul
- %TEMP%\templspcat\dwfi6891_x86.sys
- %TEMP%\templspcat\lspcuninst.exe.manifest
- %TEMP%\templspcat\lspcuninst.exe
- %TEMP%\templspcat\lspcfm.exe
- %TEMP%\templspcat\lspcdw.dll
- %TEMP%\templspcat\lspbits.exe
- %TEMP%\templspcat\lspbho64.dll
- %TEMP%\templspcat\lspbho.dll
- %TEMP%\templspcat\dwpd6891_x86.sys
- %TEMP%\templspcat\dwpd6891_x64.sys
- %TEMP%\templspcat\dwpd6891_1607_x86.sys
- %ProgramFiles%\motex\mrscripts\getpatch.vbs
- %TEMP%\templspcat\lspdnd.dll
- %TEMP%\templspcat\dwfi6891_x64.sys
- %TEMP%\templspcat\dwfi6891_1607_x86.sys
- %TEMP%\templspcat\dwfi6891_1607_x64.sys
- %TEMP%\templspcat\dwco6891_x86.sys
- %TEMP%\templspcat\dwco6891_x64.sys
- %TEMP%\templspcat\dwco6891_1607_x86.sys
- %TEMP%\templspcat\dwco6891_1607_x64.sys
- %TEMP%\templspcat\dsofile.dll
- %TEMP%\templspcat\cmr.exe
- %TEMP%\templspcat\4theyesdk6891.dll
- %TEMP%\templspcat\$
- %TEMP%\templspcat\dwpd6891_1607_x64.sys
- %ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdllog_mr_0000.ini
- %TEMP%\templspcat\lspdnd64.dll
- %TEMP%\templspcat\lspfilter_2k.sys
- %TEMP%\templspcat\lspevmon.exe
- %TEMP%\templspcat\lspwaoff.js
- %TEMP%\templspcat\lspwaoconfig.cfg
- %TEMP%\templspcat\lspwaochrome.manifest
- %TEMP%\templspcat\lsputil.dll
- %TEMP%\templspcat\lspstop.exe
- %TEMP%\templspcat\lspsrvany.exe
- %TEMP%\templspcat\lsprelay.exe
- %TEMP%\templspcat\lspquest.exe
- %TEMP%\templspcat\lspoffdevq.exe
- %TEMP%\templspcat\lspoffdev.exe
- %TEMP%\templspcat\lspevmon64.exe
- %TEMP%\templspcat\lspmladdin4x86.msi
- %TEMP%\templspcat\lspdevconf.exe
- %TEMP%\templspcat\lspmladdin2x64.msi
- %TEMP%\templspcat\lsphook64.dll
- %TEMP%\templspcat\lsphook.dll
- %TEMP%\templspcat\lspfilter_xp.sys
- %TEMP%\templspcat\lspfilter_win7_x64.sys
- %TEMP%\templspcat\lspfilter_win7.sys
- %TEMP%\templspcat\lspfilter_vista_x64.sys
- %TEMP%\templspcat\lspfilter_vista.sys
- %TEMP%\templspcat\lspfilter_2k3_x64.sys
- %TEMP%\templspcat\lspfilter_2k3.sys
- %TEMP%\templspcat\lspmladdin4x64.msi
- %ProgramFiles%\motex\mrscripts\_patchlist.txt
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\mru.ini
Удаляет следующие файлы
- %ProgramFiles%\motex\lanscope cat mr\_netsh.bat
- %ProgramFiles%\motex\lanscope cat mr\nicinfo.txt
- %ProgramFiles%\motex\mrscripts\patchlist.txt
- %ProgramFiles%\motex\mrscripts\getpatch.vbs
Перемещает следующие файлы
- %TEMP%\templspcat\$ в %WINDIR%\templspcatmr\$
- %WINDIR%\templspcatmr\lspcdw.dll в %ProgramFiles%\motex\lanscope cat mr\lspcdw.dll
- %WINDIR%\templspcatmr\lspcfm.exe в %ProgramFiles%\motex\lanscope cat mr\lspcfm.exe
- %WINDIR%\templspcatmr\lspcuninst.exe в %ProgramFiles%\motex\lanscope cat mr\lspcuninst.exe
- %WINDIR%\templspcatmr\lspcuninst.exe.manifest в %ProgramFiles%\motex\lanscope cat mr\lspcuninst.exe.manifest
- %WINDIR%\templspcatmr\lspdevconf.exe в %ProgramFiles%\motex\lanscope cat mr\lspdevconf.exe
- %WINDIR%\templspcatmr\lspdnd.dll в %ProgramFiles%\motex\lanscope cat mr\lspdnd.dll
- %WINDIR%\templspcatmr\lspevmon.exe в %ProgramFiles%\motex\lanscope cat mr\lspevmon.exe
- %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwfi6891_1607_x86.sys
- %WINDIR%\templspcatmr\lspevmon64.exe в %ProgramFiles%\motex\lanscope cat mr\lspevmon64.exe
- %WINDIR%\templspcatmr\lspfilter_2k.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k.sys
- %WINDIR%\templspcatmr\lspfilter_2k3.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k3.sys
- %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k3_x64.sys
- %WINDIR%\templspcatmr\lspfilter_vista.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_vista.sys
- %WINDIR%\templspcatmr\lspfilter_vista_x64.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_vista_x64.sys
- %WINDIR%\templspcatmr\lspbits.exe в %ProgramFiles%\motex\lanscope cat mr\lspbits.exe
- %WINDIR%\templspcatmr\lspbho64.dll в %ProgramFiles%\motex\lanscope cat mr\lspbho64.dll
- %WINDIR%\templspcatmr\lspbho.dll в %ProgramFiles%\motex\lanscope cat mr\lspbho.dll
- %WINDIR%\templspcatmr\dwpd6891_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwpd6891_x86.sys
- %WINDIR%\templspcatmr\dwpd6891_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwpd6891_x64.sys
- %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwpd6891_1607_x86.sys
- %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwpd6891_1607_x64.sys
- %WINDIR%\templspcatmr\dwfi6891_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwfi6891_x86.sys
- %WINDIR%\templspcatmr\dwfi6891_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwfi6891_x64.sys
- %WINDIR%\templspcatmr\lspdnd64.dll в %ProgramFiles%\motex\lanscope cat mr\lspdnd64.dll
- %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwfi6891_1607_x64.sys
- %WINDIR%\templspcatmr\dwco6891_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwco6891_x86.sys
- %WINDIR%\templspcatmr\dwco6891_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwco6891_x64.sys
- %WINDIR%\templspcatmr\dwco6891_1607_x86.sys в %ProgramFiles%\motex\lanscope cat mr\dwco6891_1607_x86.sys
- %WINDIR%\templspcatmr\dwco6891_1607_x64.sys в %ProgramFiles%\motex\lanscope cat mr\dwco6891_1607_x64.sys
- %WINDIR%\templspcatmr\dsofile.dll в %ProgramFiles%\motex\lanscope cat mr\dsofile.dll
- %WINDIR%\templspcatmr\cmr.exe в %ProgramFiles%\motex\lanscope cat mr\cmr.exe
- %WINDIR%\templspcatmr\lspfilter_win7.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_win7.sys
- %WINDIR%\templspcatmr\lspquest.exe в %ProgramFiles%\motex\lanscope cat mr\lspquest.exe
- %ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt в %ProgramFiles%\motex\lanscope cat mr\nicinfo.txt
- %WINDIR%\templspcatmr\lsphook.dll в %ProgramFiles%\motex\lanscope cat mr\lsphook.dll
- %WINDIR%\templspcatmr\lspwaogctomr.json в %ProgramFiles%\motex\lanscope cat mr\lspwaogctomr.json
- %WINDIR%\templspcatmr\lspwaoicon48.png в %ProgramFiles%\motex\lanscope cat mr\lspwaoicon48.png
- %WINDIR%\templspcatmr\lspwaoicon64.png в %ProgramFiles%\motex\lanscope cat mr\lspwaoicon64.png
- %WINDIR%\templspcatmr\lspwaoie.dll в %ProgramFiles%\motex\lanscope cat mr\lspwaoie.dll
- %WINDIR%\templspcatmr\lspwaoinstall.rdf в %ProgramFiles%\motex\lanscope cat mr\lspwaoinstall.rdf
- %WINDIR%\templspcatmr\lspwaomanifest.mf в %ProgramFiles%\motex\lanscope cat mr\lspwaomanifest.mf
- %WINDIR%\templspcatmr\lspwaomozilla.sf в %ProgramFiles%\motex\lanscope cat mr\lspwaomozilla.sf
- %WINDIR%\templspcatmr\lspfilter_win7_x64.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_win7_x64.sys
- %WINDIR%\templspcatmr\lspweb.dll в %ProgramFiles%\motex\lanscope cat mr\lspweb.dll
- %WINDIR%\templspcatmr\lspweb64.dll в %ProgramFiles%\motex\lanscope cat mr\lspweb64.dll
- %WINDIR%\templspcatmr\spflog.dll в %ProgramFiles%\motex\lanscope cat mr\spflog.dll
- %WINDIR%\templspcatmr\startmr.exe в %ProgramFiles%\motex\lanscope cat mr\startmr.exe
- %WINDIR%\templspcatmr\mrconf.ini в %ProgramFiles%\motex\lanscope cat mr\mrconf.ini
- %ProgramFiles%\motex\lanscope cat mr\cmr.exe в %ProgramFiles%\motex\lanscope cat mr\lspcmr.exe
- %WINDIR%\templspcatmr\lspwaogctomr.exe в %ProgramFiles%\motex\lanscope cat mr\lspwaogctomr.exe
- %WINDIR%\templspcatmr\lspwaoff.xul в %ProgramFiles%\motex\lanscope cat mr\lspwaoff.xul
- %WINDIR%\templspcatmr\lspwaoff.js в %ProgramFiles%\motex\lanscope cat mr\lspwaoff.js
- %WINDIR%\templspcatmr\lspwaoconfig.cfg в %ProgramFiles%\motex\lanscope cat mr\lspwaoconfig.cfg
- %WINDIR%\templspcatmr\lspwaochrome.manifest в %ProgramFiles%\motex\lanscope cat mr\lspwaochrome.manifest
- %WINDIR%\templspcatmr\lsputil.dll в %ProgramFiles%\motex\lanscope cat mr\lsputil.dll
- %WINDIR%\templspcatmr\lspstop.exe в %ProgramFiles%\motex\lanscope cat mr\lspstop.exe
- %WINDIR%\templspcatmr\lspsrvany.exe в %ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe
- %WINDIR%\templspcatmr\lsprelay.exe в %ProgramFiles%\motex\lanscope cat mr\lsprelay.exe
- %WINDIR%\templspcatmr\4theyesdk6891.dll в %ProgramFiles%\motex\lanscope cat mr\4theyesdk6891.dll
- %WINDIR%\templspcatmr\lspoffdevq.exe в %ProgramFiles%\motex\lanscope cat mr\lspoffdevq.exe
- %WINDIR%\templspcatmr\lspoffdev.exe в %ProgramFiles%\motex\lanscope cat mr\lspoffdev.exe
- %WINDIR%\templspcatmr\lspmladdin4x86.msi в %ProgramFiles%\motex\lanscope cat mr\lspmladdin4x86.msi
- %WINDIR%\templspcatmr\lspmladdin4x64.msi в %ProgramFiles%\motex\lanscope cat mr\lspmladdin4x64.msi
- %WINDIR%\templspcatmr\lspmladdin2x86.msi в %ProgramFiles%\motex\lanscope cat mr\lspmladdin2x86.msi
- %WINDIR%\templspcatmr\lspmladdin2x64.msi в %ProgramFiles%\motex\lanscope cat mr\lspmladdin2x64.msi
- %WINDIR%\templspcatmr\lsphook64.dll в %ProgramFiles%\motex\lanscope cat mr\lsphook64.dll
- %WINDIR%\templspcatmr\lspfilter_xp.sys в %ProgramFiles%\motex\lanscope cat mr\lspfilter_xp.sys
- %WINDIR%\templspcatmr\lspwaomozilla.rsa в %ProgramFiles%\motex\lanscope cat mr\lspwaomozilla.rsa
- %TEMP%\templspcat\startmr.exe в %WINDIR%\templspcatmr\startmr.exe
- %TEMP%\templspcat\lspwaomanifest.mf в %WINDIR%\templspcatmr\lspwaomanifest.mf
- %TEMP%\templspcat\lspbits.exe в %WINDIR%\templspcatmr\lspbits.exe
- %TEMP%\templspcat\lspcdw.dll в %WINDIR%\templspcatmr\lspcdw.dll
- %TEMP%\templspcat\lspcfm.exe в %WINDIR%\templspcatmr\lspcfm.exe
- %TEMP%\templspcat\lspcuninst.exe в %WINDIR%\templspcatmr\lspcuninst.exe
- %TEMP%\templspcat\lspcuninst.exe.manifest в %WINDIR%\templspcatmr\lspcuninst.exe.manifest
- %TEMP%\templspcat\lspdevconf.exe в %WINDIR%\templspcatmr\lspdevconf.exe
- %TEMP%\templspcat\lspdnd64.dll в %WINDIR%\templspcatmr\lspdnd64.dll
- %TEMP%\templspcat\dwfi6891_1607_x64.sys в %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys
- %TEMP%\templspcat\lspevmon.exe в %WINDIR%\templspcatmr\lspevmon.exe
- %TEMP%\templspcat\lspevmon64.exe в %WINDIR%\templspcatmr\lspevmon64.exe
- %TEMP%\templspcat\lspfilter_2k.sys в %WINDIR%\templspcatmr\lspfilter_2k.sys
- %TEMP%\templspcat\lspfilter_2k3.sys в %WINDIR%\templspcatmr\lspfilter_2k3.sys
- %TEMP%\templspcat\lspfilter_2k3_x64.sys в %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys
- %TEMP%\templspcat\lspfilter_vista.sys в %WINDIR%\templspcatmr\lspfilter_vista.sys
- %TEMP%\templspcat\lspbho64.dll в %WINDIR%\templspcatmr\lspbho64.dll
- %TEMP%\templspcat\lspbho.dll в %WINDIR%\templspcatmr\lspbho.dll
- %TEMP%\templspcat\dwpd6891_x86.sys в %WINDIR%\templspcatmr\dwpd6891_x86.sys
- %TEMP%\templspcat\dwpd6891_x64.sys в %WINDIR%\templspcatmr\dwpd6891_x64.sys
- %TEMP%\templspcat\dwpd6891_1607_x86.sys в %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys
- %TEMP%\templspcat\dwpd6891_1607_x64.sys в %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys
- %TEMP%\templspcat\dwfi6891_x86.sys в %WINDIR%\templspcatmr\dwfi6891_x86.sys
- %TEMP%\templspcat\dwfi6891_x64.sys в %WINDIR%\templspcatmr\dwfi6891_x64.sys
- %TEMP%\templspcat\dwfi6891_1607_x86.sys в %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys
- %TEMP%\templspcat\lspdnd.dll в %WINDIR%\templspcatmr\lspdnd.dll
- %TEMP%\templspcat\dwco6891_x86.sys в %WINDIR%\templspcatmr\dwco6891_x86.sys
- %TEMP%\templspcat\dwco6891_x64.sys в %WINDIR%\templspcatmr\dwco6891_x64.sys
- %TEMP%\templspcat\dwco6891_1607_x86.sys в %WINDIR%\templspcatmr\dwco6891_1607_x86.sys
- %TEMP%\templspcat\dwco6891_1607_x64.sys в %WINDIR%\templspcatmr\dwco6891_1607_x64.sys
- %TEMP%\templspcat\dsofile.dll в %WINDIR%\templspcatmr\dsofile.dll
- %TEMP%\templspcat\cmr.exe в %WINDIR%\templspcatmr\cmr.exe
- %TEMP%\templspcat\4theyesdk6891.dll в %WINDIR%\templspcatmr\4theyesdk6891.dll
- %TEMP%\templspcat\lspfilter_vista_x64.sys в %WINDIR%\templspcatmr\lspfilter_vista_x64.sys
- %TEMP%\templspcat\lspoffdevq.exe в %WINDIR%\templspcatmr\lspoffdevq.exe
- %TEMP%\templspcat\setmr.exe в %WINDIR%\templspcatmr\setmr.exe
- %TEMP%\templspcat\lspfilter_xp.sys в %WINDIR%\templspcatmr\lspfilter_xp.sys
- %TEMP%\templspcat\lspwaogctomr.exe в %WINDIR%\templspcatmr\lspwaogctomr.exe
- %TEMP%\templspcat\lspwaogctomr.json в %WINDIR%\templspcatmr\lspwaogctomr.json
- %TEMP%\templspcat\lspwaoicon48.png в %WINDIR%\templspcatmr\lspwaoicon48.png
- %TEMP%\templspcat\lspwaoicon64.png в %WINDIR%\templspcatmr\lspwaoicon64.png
- %TEMP%\templspcat\lspwaoie.dll в %WINDIR%\templspcatmr\lspwaoie.dll
- %TEMP%\templspcat\lspwaoinstall.rdf в %WINDIR%\templspcatmr\lspwaoinstall.rdf
- %TEMP%\templspcat\lspwaomozilla.rsa в %WINDIR%\templspcatmr\lspwaomozilla.rsa
- %TEMP%\templspcat\lspfilter_win7.sys в %WINDIR%\templspcatmr\lspfilter_win7.sys
- %TEMP%\templspcat\lspwaomozilla.sf в %WINDIR%\templspcatmr\lspwaomozilla.sf
- %TEMP%\templspcat\lspweb.dll в %WINDIR%\templspcatmr\lspweb.dll
- %TEMP%\templspcat\lspweb64.dll в %WINDIR%\templspcatmr\lspweb64.dll
- %TEMP%\templspcat\mr.ini в %WINDIR%\templspcatmr\mr.ini
- %TEMP%\templspcat\mrconf.ini в %WINDIR%\templspcatmr\mrconf.ini
- %TEMP%\templspcat\msg в %WINDIR%\templspcatmr\msg
- %TEMP%\templspcat\lspwaoff.xul в %WINDIR%\templspcatmr\lspwaoff.xul
- %TEMP%\templspcat\lspwaoff.js в %WINDIR%\templspcatmr\lspwaoff.js
- %TEMP%\templspcat\lspwaoconfig.cfg в %WINDIR%\templspcatmr\lspwaoconfig.cfg
- %TEMP%\templspcat\lspwaochrome.manifest в %WINDIR%\templspcatmr\lspwaochrome.manifest
- %TEMP%\templspcat\lsputil.dll в %WINDIR%\templspcatmr\lsputil.dll
- %TEMP%\templspcat\lspstop.exe в %WINDIR%\templspcatmr\lspstop.exe
- %TEMP%\templspcat\lspsrvany.exe в %WINDIR%\templspcatmr\lspsrvany.exe
- %TEMP%\templspcat\lsprelay.exe в %WINDIR%\templspcatmr\lsprelay.exe
- %TEMP%\templspcat\lspquest.exe в %WINDIR%\templspcatmr\lspquest.exe
- %TEMP%\templspcat\spflog.dll в %WINDIR%\templspcatmr\spflog.dll
- %TEMP%\templspcat\lspoffdev.exe в %WINDIR%\templspcatmr\lspoffdev.exe
- %TEMP%\templspcat\lspmladdin4x86.msi в %WINDIR%\templspcatmr\lspmladdin4x86.msi
- %TEMP%\templspcat\lspmladdin4x64.msi в %WINDIR%\templspcatmr\lspmladdin4x64.msi
- %TEMP%\templspcat\lspmladdin2x86.msi в %WINDIR%\templspcatmr\lspmladdin2x86.msi
- %TEMP%\templspcat\lspmladdin2x64.msi в %WINDIR%\templspcatmr\lspmladdin2x64.msi
- %TEMP%\templspcat\lsphook64.dll в %WINDIR%\templspcatmr\lsphook64.dll
- %TEMP%\templspcat\lsphook.dll в %WINDIR%\templspcatmr\lsphook.dll
- %TEMP%\templspcat\lspfilter_win7_x64.sys в %WINDIR%\templspcatmr\lspfilter_win7_x64.sys
- %ProgramFiles%\motex\mrscripts\_patchlist.txt в %ProgramFiles%\motex\mrscripts\patchlist.txt
Подменяет следующие файлы
- %ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt
- %ProgramFiles%\motex\lanscope cat mr\nicinfo.txt
Сетевая активность
Подключается к
- '54.##8.226.187':38002
Другое
Ищет следующие окна
- ClassName: 'TMainForm' WindowName: 'LanScope Cat'
Создает и запускает на исполнение
- '%WINDIR%\templspcatmr\setmr.exe' i smsg fmsg
- '%ProgramFiles%\motex\lanscope cat mr\startmr.exe' smsg fmsg
- '%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent
- '%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe'
- '%ProgramFiles%\motex\lanscope cat mr\lspcmr.exe' smsg fmsg
- '<SYSTEM32>\cscript.exe' "%ProgramFiles%\MOTEX\MRScripts\GetPatch.vbs"
- '%ProgramFiles%\motex\lanscope cat mr\startmr.exe' smsg fmsg' (со скрытым окном)
- '%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent' (со скрытым окном)
- '%ProgramFiles%\motex\lanscope cat mr\lspcmr.exe' smsg fmsg' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\lanscope cat mr\_NICInfo.txt"' (со скрытым окном)
- '<SYSTEM32>\cscript.exe' "%ProgramFiles%\MOTEX\MRScripts\GetPatch.vbs"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\MOTEX\LanScope Cat MR\_netsh.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' localhost -n 2
- '<SYSTEM32>\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\lanscope cat mr\_NICInfo.txt"
- '<SYSTEM32>\ipconfig.exe' /all
