Trojan.Siggen9.6614

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\Startmr.exe"'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
[<HKLM>\SYSTEM\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '"%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\LspSrvAny.exe"'

Изменения в файловой системе

Создает следующие файлы

%PROGRAMDATA%\motex\mr\mrinst_decmp_utf8.log
%PROGRAMDATA%\motex\mr\mrinst_start_utf8.log
%WINDIR%\setmr.exe
%WINDIR%\mru.ini
%PROGRAMDATA%\motex\mr\mrinst_set_utf8.log
%TEMP%\templspcat\startmr.exe
%TEMP%\templspcat\spflog.dll
%TEMP%\templspcat\setmr.exe
%TEMP%\templspcat\msg
%TEMP%\templspcat\mr.ini
%TEMP%\templspcat\mozilla.sf
%TEMP%\templspcat\mozilla.rsa
%TEMP%\templspcat\manifest.mf
%TEMP%\templspcat\lspweb64.dll
%TEMP%\templspcat\lspweb.dll
%TEMP%\templspcat\lspwaomozilla.sf
%TEMP%\templspcat\lspwaomozilla.rsa
%TEMP%\templspcat\lspwaomanifest.mf
%TEMP%\templspcat\lspwaoinstall.rdf
%TEMP%\templspcat\lspwaoie.dll
%TEMP%\templspcat\lspwaoiconext48.png
%TEMP%\templspcat\lspwaoiconext16.png
%TEMP%\templspcat\lspwaoiconext128.png
%TEMP%\templspcat\lspwaoicon64.png
%TEMP%\templspcat\lspwaoicon48.png
%TEMP%\templspcat\lspwaogctomr.json
%TEMP%\templspcat\lspwaogctomr.exe
%TEMP%\templspcat\lspwaofftomr.json
%TEMP%\templspcat\lspwaoffgoogledrive.js
%TEMP%\templspcat\lspwaoffdom.js
%PROGRAMDATA%\motex\mr\mrinst_mr_utf8.log
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_alzlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_apclog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_aptsk_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_apclog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\tracelog\delivery_20200127_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\ontimestamp_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\lontimestamp_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_fileio_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_lonloflog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_devlog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_walog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_eventmr_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_prnlog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_forbidap_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_aptsk_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_ddllog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdlrlylog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdllog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_invalmlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_wualog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_smllog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_itclog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_walog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_eventmr_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_thrlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdvlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_lonloflog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_devlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_eventmr_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_prnlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_forbidap_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_aptsk_mr_0001.ini
%TEMP%\templspcat\lspwaoffbackground.js
%ProgramFiles%\motex\lansco~1\_nicinfo.txt
%TEMP%\templspcat\lspwaoffbackground.html
%TEMP%\templspcat\lspetwapi.dll
%TEMP%\templspcat\lspdnd.dll
%TEMP%\templspcat\lspdevconf.exe
%TEMP%\templspcat\lspcuninst.exe.manifest
%TEMP%\templspcat\lspcuninst.exe
%TEMP%\templspcat\lspcfm.exe
%TEMP%\templspcat\lspcdw.dll
%TEMP%\templspcat\lspbits.exe
%TEMP%\templspcat\lspbho64.dll
%TEMP%\templspcat\lspbho.dll
%TEMP%\templspcat\lspadv.exe
%TEMP%\templspcat\dwpd6891_x86.sys
%TEMP%\templspcat\dwpd6891_x64.sys
%TEMP%\templspcat\dwpd6891_1607_x86.sys
%TEMP%\templspcat\dwpd6891_1607_x64.sys
%TEMP%\templspcat\dwfi6891_x86.sys
%TEMP%\templspcat\dwfi6891_x64.sys
%TEMP%\templspcat\dwfi6891_1607_x86.sys
%TEMP%\templspcat\dwfi6891_1607_x64.sys
%TEMP%\templspcat\dwco6891_x86.sys
%TEMP%\templspcat\dwco6891_x64.sys
%TEMP%\templspcat\dwco6891_1607_x86.sys
%TEMP%\templspcat\dwco6891_1607_x64.sys
%TEMP%\templspcat\dsofile.dll
%TEMP%\templspcat\cose.sig
%TEMP%\templspcat\cose.manifest
%TEMP%\templspcat\cmr.exe
%TEMP%\templspcat\4theyesdk6891_1607.dll
%TEMP%\templspcat\4theyesdk6891.dll
%TEMP%\templspcat\$
%TEMP%\templspcat\lspdnd64.dll
%TEMP%\templspcat\lspevmon.exe
%TEMP%\templspcat\lspwaoff.js
%TEMP%\templspcat\lspevmon64.exe
%TEMP%\templspcat\lspwaoconfig.cfg
%TEMP%\templspcat\lspwaochrome.manifest
%TEMP%\templspcat\lsputil.dll
%TEMP%\templspcat\lspstop.exe
%TEMP%\templspcat\lspsrvany.exe
%TEMP%\templspcat\lsprelay.exe
%TEMP%\templspcat\lspquest.exe
%TEMP%\templspcat\lspoffdevq.exe
%TEMP%\templspcat\lspoffdev.exe
%TEMP%\templspcat\lspmlvaddin40x86.msi
%TEMP%\templspcat\lspmlvaddin40x64.msi
%TEMP%\templspcat\lspmlvaddin35x86.msi
%TEMP%\templspcat\lspmlvaddin35x64.msi
%TEMP%\templspcat\lspmladdin4x86.msi
%TEMP%\templspcat\lspmladdin4x64.msi
%TEMP%\templspcat\lspmladdin2x86.msi
%TEMP%\templspcat\lspmladdin2x64.msi
%TEMP%\templspcat\lspmanifest_ff.json
%TEMP%\templspcat\lsphook64.dll
%TEMP%\templspcat\lsphook.dll
%TEMP%\templspcat\lspfilter_xp.sys
%TEMP%\templspcat\lspfilter_win7_x64.sys
%TEMP%\templspcat\lspfilter_win7.sys
%TEMP%\templspcat\lspfilter_vista_x64.sys
%TEMP%\templspcat\lspfilter_vista.sys
%TEMP%\templspcat\lspfilter_2k3_x64.sys
%TEMP%\templspcat\lspfilter_2k3.sys
%TEMP%\templspcat\lspfilter_2k.sys
%TEMP%\templspcat\lspffaddonxpi@motex.co.jp.xpi
%TEMP%\templspcat\lspwaoff.xul
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\analyzelog\20200127\lspalz_utf8_0001.txt

Присваивает атрибут 'скрытый' для следующих файлов

%WINDIR%\mru.ini

Удаляет следующие файлы

%ProgramFiles%\motex\lansco~1\nicinfo.txt

Перемещает следующие файлы

%TEMP%\templspcat\$ в %WINDIR%\templspcatmr\$
%WINDIR%\templspcatmr\lspcuninst.exe.manifest в %ProgramFiles(x86)%\motex\lanscope cat mr\lspcuninst.exe.manifest
%WINDIR%\templspcatmr\lspdevconf.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspdevconf.exe
%WINDIR%\templspcatmr\lspdnd.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspdnd.dll
%WINDIR%\templspcatmr\lspdnd64.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspdnd64.dll
%WINDIR%\templspcatmr\lspetwapi.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspetwapi.dll
%WINDIR%\templspcatmr\lspevmon.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspevmon.exe
%WINDIR%\templspcatmr\lspevmon64.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspevmon64.exe
%WINDIR%\templspcatmr\lspcfm.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspcfm.exe
%WINDIR%\templspcatmr\lspcuninst.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspcuninst.exe
%WINDIR%\templspcatmr\lspffaddonxpi@motex.co.jp.xpi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspffaddonxpi@motex.co.jp.xpi
%WINDIR%\templspcatmr\lspfilter_2k3_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k3_x64.sys
%WINDIR%\templspcatmr\lspfilter_vista.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_vista.sys
%WINDIR%\templspcatmr\lspfilter_vista_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_vista_x64.sys
%WINDIR%\templspcatmr\lspfilter_win7.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_win7.sys
%WINDIR%\templspcatmr\lspfilter_win7_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_win7_x64.sys
%WINDIR%\templspcatmr\lspfilter_xp.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_xp.sys
%WINDIR%\templspcatmr\lsphook.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lsphook.dll
%WINDIR%\templspcatmr\lspfilter_2k.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k.sys
%WINDIR%\templspcatmr\lspfilter_2k3.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k3.sys
%WINDIR%\templspcatmr\lspcdw.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspcdw.dll
%WINDIR%\templspcatmr\lspbits.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspbits.exe
%WINDIR%\templspcatmr\lspbho64.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspbho64.dll
%WINDIR%\templspcatmr\cmr.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\cmr.exe
%WINDIR%\templspcatmr\cose.manifest в %ProgramFiles(x86)%\motex\lanscope cat mr\cose.manifest
%WINDIR%\templspcatmr\cose.sig в %ProgramFiles(x86)%\motex\lanscope cat mr\cose.sig
%WINDIR%\templspcatmr\dsofile.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\dsofile.dll
%WINDIR%\templspcatmr\dwco6891_1607_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_1607_x64.sys
%WINDIR%\templspcatmr\dwco6891_1607_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_1607_x86.sys
%WINDIR%\templspcatmr\dwco6891_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_x64.sys
%WINDIR%\templspcatmr\dwco6891_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_x86.sys
%WINDIR%\templspcatmr\4theyesdk6891_1607.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891_1607.dll
%WINDIR%\templspcatmr\dwfi6891_1607_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_1607_x64.sys
%WINDIR%\templspcatmr\dwfi6891_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_x64.sys
%WINDIR%\templspcatmr\dwfi6891_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_x86.sys
%WINDIR%\templspcatmr\dwpd6891_1607_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_1607_x64.sys
%WINDIR%\templspcatmr\dwpd6891_1607_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_1607_x86.sys
%WINDIR%\templspcatmr\dwpd6891_x64.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_x64.sys
%WINDIR%\templspcatmr\dwpd6891_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_x86.sys
%WINDIR%\templspcatmr\lspadv.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspadv.exe
%WINDIR%\templspcatmr\lspbho.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspbho.dll
%WINDIR%\templspcatmr\dwfi6891_1607_x86.sys в %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_1607_x86.sys
%WINDIR%\templspcatmr\lsphook64.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lsphook64.dll
%WINDIR%\templspcatmr\lspmanifest_ff.json в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmanifest_ff.json
%WINDIR%\templspcatmr\lspmladdin2x64.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin2x64.msi
%WINDIR%\templspcatmr\lspmladdin2x86.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin2x86.msi
%WINDIR%\templspcatmr\lspwaogctomr.json в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaogctomr.json
%WINDIR%\templspcatmr\lspwaoicon48.png в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoicon48.png
%WINDIR%\templspcatmr\lspwaoicon64.png в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoicon64.png
%WINDIR%\templspcatmr\lspwaoiconext128.png в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext128.png
%WINDIR%\templspcatmr\lspwaoiconext16.png в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext16.png
%WINDIR%\templspcatmr\lspwaoiconext48.png в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext48.png
%WINDIR%\templspcatmr\lspwaoie.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoie.dll
%WINDIR%\templspcatmr\lspwaoinstall.rdf в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoinstall.rdf
%WINDIR%\templspcatmr\lspwaomanifest.mf в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomanifest.mf
%WINDIR%\templspcatmr\lspwaomozilla.rsa в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomozilla.rsa
%WINDIR%\templspcatmr\lspwaomozilla.sf в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomozilla.sf
%WINDIR%\templspcatmr\lspweb.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspweb.dll
%WINDIR%\templspcatmr\lspweb64.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lspweb64.dll
%WINDIR%\templspcatmr\manifest.mf в %ProgramFiles(x86)%\motex\lanscope cat mr\manifest.mf
%WINDIR%\templspcatmr\mozilla.rsa в %ProgramFiles(x86)%\motex\lanscope cat mr\mozilla.rsa
%WINDIR%\templspcatmr\mozilla.sf в %ProgramFiles(x86)%\motex\lanscope cat mr\mozilla.sf
%WINDIR%\templspcatmr\spflog.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\spflog.dll
%WINDIR%\templspcatmr\startmr.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe
%ProgramFiles(x86)%\motex\lanscope cat mr\cmr.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe
%WINDIR%\templspcatmr\lspwaogctomr.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaogctomr.exe
%WINDIR%\templspcatmr\lspwaoffgoogledrive.js в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffgoogledrive.js
%WINDIR%\templspcatmr\lspwaofftomr.json в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaofftomr.json
%WINDIR%\templspcatmr\lspwaoffdom.js в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffdom.js
%WINDIR%\templspcatmr\lspmladdin4x64.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin4x64.msi
%WINDIR%\templspcatmr\lspmladdin4x86.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin4x86.msi
%WINDIR%\templspcatmr\lspmlvaddin35x64.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin35x64.msi
%WINDIR%\templspcatmr\lspmlvaddin35x86.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin35x86.msi
%WINDIR%\templspcatmr\lspmlvaddin40x64.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin40x64.msi
%WINDIR%\templspcatmr\lspmlvaddin40x86.msi в %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin40x86.msi
%WINDIR%\templspcatmr\lspoffdev.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspoffdev.exe
%WINDIR%\templspcatmr\lspoffdevq.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspoffdevq.exe
%WINDIR%\templspcatmr\lspquest.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspquest.exe
%WINDIR%\templspcatmr\lsprelay.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lsprelay.exe
%WINDIR%\templspcatmr\lspsrvany.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe
%WINDIR%\templspcatmr\lspstop.exe в %ProgramFiles(x86)%\motex\lanscope cat mr\lspstop.exe
%WINDIR%\templspcatmr\lsputil.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\lsputil.dll
%WINDIR%\templspcatmr\lspwaochrome.manifest в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaochrome.manifest
%WINDIR%\templspcatmr\lspwaoconfig.cfg в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoconfig.cfg
%WINDIR%\templspcatmr\lspwaoff.js в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoff.js
%WINDIR%\templspcatmr\lspwaoff.xul в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoff.xul
%WINDIR%\templspcatmr\lspwaoffbackground.html в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffbackground.html
%WINDIR%\templspcatmr\lspwaoffbackground.js в %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffbackground.js
%ProgramFiles%\motex\lansco~1\_nicinfo.txt в %ProgramFiles%\motex\lansco~1\nicinfo.txt
%WINDIR%\templspcatmr\4theyesdk6891.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891.dll
%TEMP%\templspcat\startmr.exe в %WINDIR%\templspcatmr\startmr.exe
%TEMP%\templspcat\spflog.dll в %WINDIR%\templspcatmr\spflog.dll
%TEMP%\templspcat\lspcuninst.exe в %WINDIR%\templspcatmr\lspcuninst.exe
%TEMP%\templspcat\lspcuninst.exe.manifest в %WINDIR%\templspcatmr\lspcuninst.exe.manifest
%TEMP%\templspcat\lspdevconf.exe в %WINDIR%\templspcatmr\lspdevconf.exe
%TEMP%\templspcat\lspdnd.dll в %WINDIR%\templspcatmr\lspdnd.dll
%TEMP%\templspcat\lspdnd64.dll в %WINDIR%\templspcatmr\lspdnd64.dll
%TEMP%\templspcat\lspetwapi.dll в %WINDIR%\templspcatmr\lspetwapi.dll
%TEMP%\templspcat\lspevmon.exe в %WINDIR%\templspcatmr\lspevmon.exe
%TEMP%\templspcat\lspcdw.dll в %WINDIR%\templspcatmr\lspcdw.dll
%TEMP%\templspcat\lspcfm.exe в %WINDIR%\templspcatmr\lspcfm.exe
%TEMP%\templspcat\lspevmon64.exe в %WINDIR%\templspcatmr\lspevmon64.exe
%TEMP%\templspcat\lspfilter_2k3.sys в %WINDIR%\templspcatmr\lspfilter_2k3.sys
%TEMP%\templspcat\lspfilter_2k3_x64.sys в %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys
%TEMP%\templspcat\lspfilter_vista.sys в %WINDIR%\templspcatmr\lspfilter_vista.sys
%TEMP%\templspcat\lspfilter_vista_x64.sys в %WINDIR%\templspcatmr\lspfilter_vista_x64.sys
%TEMP%\templspcat\lspfilter_win7.sys в %WINDIR%\templspcatmr\lspfilter_win7.sys
%TEMP%\templspcat\lspfilter_win7_x64.sys в %WINDIR%\templspcatmr\lspfilter_win7_x64.sys
%TEMP%\templspcat\lspfilter_xp.sys в %WINDIR%\templspcatmr\lspfilter_xp.sys
%TEMP%\templspcat\lspffaddonxpi@motex.co.jp.xpi в %WINDIR%\templspcatmr\lspffaddonxpi@motex.co.jp.xpi
%TEMP%\templspcat\lspfilter_2k.sys в %WINDIR%\templspcatmr\lspfilter_2k.sys
%TEMP%\templspcat\lspbits.exe в %WINDIR%\templspcatmr\lspbits.exe
%TEMP%\templspcat\lspbho64.dll в %WINDIR%\templspcatmr\lspbho64.dll
%TEMP%\templspcat\lspbho.dll в %WINDIR%\templspcatmr\lspbho.dll
%TEMP%\templspcat\4theyesdk6891_1607.dll в %WINDIR%\templspcatmr\4theyesdk6891_1607.dll
%TEMP%\templspcat\cmr.exe в %WINDIR%\templspcatmr\cmr.exe
%TEMP%\templspcat\cose.manifest в %WINDIR%\templspcatmr\cose.manifest
%TEMP%\templspcat\cose.sig в %WINDIR%\templspcatmr\cose.sig
%TEMP%\templspcat\dsofile.dll в %WINDIR%\templspcatmr\dsofile.dll
%TEMP%\templspcat\dwco6891_1607_x64.sys в %WINDIR%\templspcatmr\dwco6891_1607_x64.sys
%TEMP%\templspcat\dwco6891_1607_x86.sys в %WINDIR%\templspcatmr\dwco6891_1607_x86.sys
%TEMP%\templspcat\dwco6891_x64.sys в %WINDIR%\templspcatmr\dwco6891_x64.sys
%TEMP%\templspcat\4theyesdk6891.dll в %WINDIR%\templspcatmr\4theyesdk6891.dll
%TEMP%\templspcat\dwco6891_x86.sys в %WINDIR%\templspcatmr\dwco6891_x86.sys
%TEMP%\templspcat\dwfi6891_1607_x86.sys в %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys
%TEMP%\templspcat\dwfi6891_x64.sys в %WINDIR%\templspcatmr\dwfi6891_x64.sys
%TEMP%\templspcat\dwfi6891_x86.sys в %WINDIR%\templspcatmr\dwfi6891_x86.sys
%TEMP%\templspcat\dwpd6891_1607_x64.sys в %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys
%TEMP%\templspcat\dwpd6891_1607_x86.sys в %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys
%TEMP%\templspcat\dwpd6891_x64.sys в %WINDIR%\templspcatmr\dwpd6891_x64.sys
%TEMP%\templspcat\dwpd6891_x86.sys в %WINDIR%\templspcatmr\dwpd6891_x86.sys
%TEMP%\templspcat\lspadv.exe в %WINDIR%\templspcatmr\lspadv.exe
%TEMP%\templspcat\dwfi6891_1607_x64.sys в %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys
%TEMP%\templspcat\lsphook.dll в %WINDIR%\templspcatmr\lsphook.dll
%TEMP%\templspcat\lsphook64.dll в %WINDIR%\templspcatmr\lsphook64.dll
%TEMP%\templspcat\lspmanifest_ff.json в %WINDIR%\templspcatmr\lspmanifest_ff.json
%TEMP%\templspcat\lspmladdin2x64.msi в %WINDIR%\templspcatmr\lspmladdin2x64.msi
%TEMP%\templspcat\lspwaogctomr.exe в %WINDIR%\templspcatmr\lspwaogctomr.exe
%TEMP%\templspcat\lspwaogctomr.json в %WINDIR%\templspcatmr\lspwaogctomr.json
%TEMP%\templspcat\lspwaoicon48.png в %WINDIR%\templspcatmr\lspwaoicon48.png
%TEMP%\templspcat\lspwaoicon64.png в %WINDIR%\templspcatmr\lspwaoicon64.png
%TEMP%\templspcat\lspwaoiconext128.png в %WINDIR%\templspcatmr\lspwaoiconext128.png
%TEMP%\templspcat\lspwaoiconext16.png в %WINDIR%\templspcatmr\lspwaoiconext16.png
%TEMP%\templspcat\lspwaoiconext48.png в %WINDIR%\templspcatmr\lspwaoiconext48.png
%TEMP%\templspcat\lspwaoie.dll в %WINDIR%\templspcatmr\lspwaoie.dll
%TEMP%\templspcat\lspwaoinstall.rdf в %WINDIR%\templspcatmr\lspwaoinstall.rdf
%TEMP%\templspcat\lspwaomanifest.mf в %WINDIR%\templspcatmr\lspwaomanifest.mf
%TEMP%\templspcat\lspwaomozilla.rsa в %WINDIR%\templspcatmr\lspwaomozilla.rsa
%TEMP%\templspcat\lspwaomozilla.sf в %WINDIR%\templspcatmr\lspwaomozilla.sf
%TEMP%\templspcat\lspweb.dll в %WINDIR%\templspcatmr\lspweb.dll
%TEMP%\templspcat\lspweb64.dll в %WINDIR%\templspcatmr\lspweb64.dll
%TEMP%\templspcat\manifest.mf в %WINDIR%\templspcatmr\manifest.mf
%TEMP%\templspcat\mozilla.rsa в %WINDIR%\templspcatmr\mozilla.rsa
%TEMP%\templspcat\mozilla.sf в %WINDIR%\templspcatmr\mozilla.sf
%TEMP%\templspcat\mr.ini в %WINDIR%\templspcatmr\mr.ini
%TEMP%\templspcat\msg в %WINDIR%\templspcatmr\msg
%TEMP%\templspcat\lspwaofftomr.json в %WINDIR%\templspcatmr\lspwaofftomr.json
%TEMP%\templspcat\lspwaoffdom.js в %WINDIR%\templspcatmr\lspwaoffdom.js
%TEMP%\templspcat\lspwaoffgoogledrive.js в %WINDIR%\templspcatmr\lspwaoffgoogledrive.js
%TEMP%\templspcat\lspwaoffbackground.js в %WINDIR%\templspcatmr\lspwaoffbackground.js
%TEMP%\templspcat\lspmladdin2x86.msi в %WINDIR%\templspcatmr\lspmladdin2x86.msi
%TEMP%\templspcat\lspmladdin4x64.msi в %WINDIR%\templspcatmr\lspmladdin4x64.msi
%TEMP%\templspcat\lspmladdin4x86.msi в %WINDIR%\templspcatmr\lspmladdin4x86.msi
%TEMP%\templspcat\lspmlvaddin35x64.msi в %WINDIR%\templspcatmr\lspmlvaddin35x64.msi
%TEMP%\templspcat\lspmlvaddin35x86.msi в %WINDIR%\templspcatmr\lspmlvaddin35x86.msi
%TEMP%\templspcat\lspmlvaddin40x64.msi в %WINDIR%\templspcatmr\lspmlvaddin40x64.msi
%TEMP%\templspcat\lspmlvaddin40x86.msi в %WINDIR%\templspcatmr\lspmlvaddin40x86.msi
%TEMP%\templspcat\lspoffdev.exe в %WINDIR%\templspcatmr\lspoffdev.exe
%TEMP%\templspcat\lspoffdevq.exe в %WINDIR%\templspcatmr\lspoffdevq.exe
%TEMP%\templspcat\lspquest.exe в %WINDIR%\templspcatmr\lspquest.exe
%TEMP%\templspcat\lsprelay.exe в %WINDIR%\templspcatmr\lsprelay.exe
%TEMP%\templspcat\lspsrvany.exe в %WINDIR%\templspcatmr\lspsrvany.exe
%TEMP%\templspcat\lspstop.exe в %WINDIR%\templspcatmr\lspstop.exe
%TEMP%\templspcat\lsputil.dll в %WINDIR%\templspcatmr\lsputil.dll
%TEMP%\templspcat\lspwaochrome.manifest в %WINDIR%\templspcatmr\lspwaochrome.manifest
%TEMP%\templspcat\lspwaoconfig.cfg в %WINDIR%\templspcatmr\lspwaoconfig.cfg
%TEMP%\templspcat\lspwaoff.js в %WINDIR%\templspcatmr\lspwaoff.js
%TEMP%\templspcat\lspwaoff.xul в %WINDIR%\templspcatmr\lspwaoff.xul
%TEMP%\templspcat\lspwaoffbackground.html в %WINDIR%\templspcatmr\lspwaoffbackground.html
%TEMP%\templspcat\setmr.exe в %WINDIR%\templspcatmr\setmr.exe
%ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891_1607.dll в %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891.dll

Сетевая активность

Подключается к

'<LOCALNET>.201.47':38002

Другое

Ищет следующие окна

ClassName: 'TMainForm' WindowName: 'LanScope Cat'

Создает и запускает на исполнение

'%WINDIR%\templspcatmr\setmr.exe' i smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe' smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe'
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe' smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe' smsg reboot' (со скрытым окном)
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent' (со скрытым окном)
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe' smsg reboot' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\LANSCO~1\_NICInfo.txt"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c arp -d' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\LANSCO~1\_NICInfo.txt"
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\cmd.exe' /c arp -d
'%WINDIR%\syswow64\arp.exe' -d

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней