Trojan.Siggen9.6614

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\Startmr.exe"'

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
[<HKLM>\SYSTEM\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '"%ProgramFiles(x86)%\MOTEX\LanScope Cat MR\LspSrvAny.exe"'

Modifies file system

Creates the following files

%PROGRAMDATA%\motex\mr\mrinst_decmp_utf8.log
%PROGRAMDATA%\motex\mr\mrinst_start_utf8.log
%WINDIR%\setmr.exe
%WINDIR%\mru.ini
%PROGRAMDATA%\motex\mr\mrinst_set_utf8.log
%TEMP%\templspcat\startmr.exe
%TEMP%\templspcat\spflog.dll
%TEMP%\templspcat\setmr.exe
%TEMP%\templspcat\msg
%TEMP%\templspcat\mr.ini
%TEMP%\templspcat\mozilla.sf
%TEMP%\templspcat\mozilla.rsa
%TEMP%\templspcat\manifest.mf
%TEMP%\templspcat\lspweb64.dll
%TEMP%\templspcat\lspweb.dll
%TEMP%\templspcat\lspwaomozilla.sf
%TEMP%\templspcat\lspwaomozilla.rsa
%TEMP%\templspcat\lspwaomanifest.mf
%TEMP%\templspcat\lspwaoinstall.rdf
%TEMP%\templspcat\lspwaoie.dll
%TEMP%\templspcat\lspwaoiconext48.png
%TEMP%\templspcat\lspwaoiconext16.png
%TEMP%\templspcat\lspwaoiconext128.png
%TEMP%\templspcat\lspwaoicon64.png
%TEMP%\templspcat\lspwaoicon48.png
%TEMP%\templspcat\lspwaogctomr.json
%TEMP%\templspcat\lspwaogctomr.exe
%TEMP%\templspcat\lspwaofftomr.json
%TEMP%\templspcat\lspwaoffgoogledrive.js
%TEMP%\templspcat\lspwaoffdom.js
%PROGRAMDATA%\motex\mr\mrinst_mr_utf8.log
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_alzlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_apclog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_aptsk_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_apclog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\tracelog\delivery_20200127_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\ontimestamp_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\lontimestamp_utf8.txt
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_fileio_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_lonloflog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_devlog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_walog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_eventmr_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_prnlog_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_forbidap_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\uno_aptsk_mr.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_ddllog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdlrlylog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdllog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_invalmlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_wualog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_smllog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_itclog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_walog_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_eventmr_ev_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_thrlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_cdvlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_lonloflog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_devlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_eventmr_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_prnlog_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\uno_forbidap_mr_0001.ini
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\0001\seqno_aptsk_mr_0001.ini
%TEMP%\templspcat\lspwaoffbackground.js
%ProgramFiles%\motex\lansco~1\_nicinfo.txt
%TEMP%\templspcat\lspwaoffbackground.html
%TEMP%\templspcat\lspetwapi.dll
%TEMP%\templspcat\lspdnd.dll
%TEMP%\templspcat\lspdevconf.exe
%TEMP%\templspcat\lspcuninst.exe.manifest
%TEMP%\templspcat\lspcuninst.exe
%TEMP%\templspcat\lspcfm.exe
%TEMP%\templspcat\lspcdw.dll
%TEMP%\templspcat\lspbits.exe
%TEMP%\templspcat\lspbho64.dll
%TEMP%\templspcat\lspbho.dll
%TEMP%\templspcat\lspadv.exe
%TEMP%\templspcat\dwpd6891_x86.sys
%TEMP%\templspcat\dwpd6891_x64.sys
%TEMP%\templspcat\dwpd6891_1607_x86.sys
%TEMP%\templspcat\dwpd6891_1607_x64.sys
%TEMP%\templspcat\dwfi6891_x86.sys
%TEMP%\templspcat\dwfi6891_x64.sys
%TEMP%\templspcat\dwfi6891_1607_x86.sys
%TEMP%\templspcat\dwfi6891_1607_x64.sys
%TEMP%\templspcat\dwco6891_x86.sys
%TEMP%\templspcat\dwco6891_x64.sys
%TEMP%\templspcat\dwco6891_1607_x86.sys
%TEMP%\templspcat\dwco6891_1607_x64.sys
%TEMP%\templspcat\dsofile.dll
%TEMP%\templspcat\cose.sig
%TEMP%\templspcat\cose.manifest
%TEMP%\templspcat\cmr.exe
%TEMP%\templspcat\4theyesdk6891_1607.dll
%TEMP%\templspcat\4theyesdk6891.dll
%TEMP%\templspcat\$
%TEMP%\templspcat\lspdnd64.dll
%TEMP%\templspcat\lspevmon.exe
%TEMP%\templspcat\lspwaoff.js
%TEMP%\templspcat\lspevmon64.exe
%TEMP%\templspcat\lspwaoconfig.cfg
%TEMP%\templspcat\lspwaochrome.manifest
%TEMP%\templspcat\lsputil.dll
%TEMP%\templspcat\lspstop.exe
%TEMP%\templspcat\lspsrvany.exe
%TEMP%\templspcat\lsprelay.exe
%TEMP%\templspcat\lspquest.exe
%TEMP%\templspcat\lspoffdevq.exe
%TEMP%\templspcat\lspoffdev.exe
%TEMP%\templspcat\lspmlvaddin40x86.msi
%TEMP%\templspcat\lspmlvaddin40x64.msi
%TEMP%\templspcat\lspmlvaddin35x86.msi
%TEMP%\templspcat\lspmlvaddin35x64.msi
%TEMP%\templspcat\lspmladdin4x86.msi
%TEMP%\templspcat\lspmladdin4x64.msi
%TEMP%\templspcat\lspmladdin2x86.msi
%TEMP%\templspcat\lspmladdin2x64.msi
%TEMP%\templspcat\lspmanifest_ff.json
%TEMP%\templspcat\lsphook64.dll
%TEMP%\templspcat\lsphook.dll
%TEMP%\templspcat\lspfilter_xp.sys
%TEMP%\templspcat\lspfilter_win7_x64.sys
%TEMP%\templspcat\lspfilter_win7.sys
%TEMP%\templspcat\lspfilter_vista_x64.sys
%TEMP%\templspcat\lspfilter_vista.sys
%TEMP%\templspcat\lspfilter_2k3_x64.sys
%TEMP%\templspcat\lspfilter_2k3.sys
%TEMP%\templspcat\lspfilter_2k.sys
%TEMP%\templspcat\lspffaddonxpi@motex.co.jp.xpi
%TEMP%\templspcat\lspwaoff.xul
%ProgramFiles(x86)%\motex\lanscope cat mr\locallog\analyzelog\20200127\lspalz_utf8_0001.txt

Sets the 'hidden' attribute to the following files

%WINDIR%\mru.ini

Deletes the following files

%ProgramFiles%\motex\lansco~1\nicinfo.txt

Moves the following files

from %TEMP%\templspcat\$ to %WINDIR%\templspcatmr\$
from %WINDIR%\templspcatmr\lspcuninst.exe.manifest to %ProgramFiles(x86)%\motex\lanscope cat mr\lspcuninst.exe.manifest
from %WINDIR%\templspcatmr\lspdevconf.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspdevconf.exe
from %WINDIR%\templspcatmr\lspdnd.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspdnd.dll
from %WINDIR%\templspcatmr\lspdnd64.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspdnd64.dll
from %WINDIR%\templspcatmr\lspetwapi.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspetwapi.dll
from %WINDIR%\templspcatmr\lspevmon.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspevmon.exe
from %WINDIR%\templspcatmr\lspevmon64.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspevmon64.exe
from %WINDIR%\templspcatmr\lspcfm.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspcfm.exe
from %WINDIR%\templspcatmr\lspcuninst.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspcuninst.exe
from %WINDIR%\templspcatmr\lspffaddonxpi@motex.co.jp.xpi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspffaddonxpi@motex.co.jp.xpi
from %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k3_x64.sys
from %WINDIR%\templspcatmr\lspfilter_vista.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_vista.sys
from %WINDIR%\templspcatmr\lspfilter_vista_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_vista_x64.sys
from %WINDIR%\templspcatmr\lspfilter_win7.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_win7.sys
from %WINDIR%\templspcatmr\lspfilter_win7_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_win7_x64.sys
from %WINDIR%\templspcatmr\lspfilter_xp.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_xp.sys
from %WINDIR%\templspcatmr\lsphook.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lsphook.dll
from %WINDIR%\templspcatmr\lspfilter_2k.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k.sys
from %WINDIR%\templspcatmr\lspfilter_2k3.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\lspfilter_2k3.sys
from %WINDIR%\templspcatmr\lspcdw.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspcdw.dll
from %WINDIR%\templspcatmr\lspbits.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspbits.exe
from %WINDIR%\templspcatmr\lspbho64.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspbho64.dll
from %WINDIR%\templspcatmr\cmr.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\cmr.exe
from %WINDIR%\templspcatmr\cose.manifest to %ProgramFiles(x86)%\motex\lanscope cat mr\cose.manifest
from %WINDIR%\templspcatmr\cose.sig to %ProgramFiles(x86)%\motex\lanscope cat mr\cose.sig
from %WINDIR%\templspcatmr\dsofile.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\dsofile.dll
from %WINDIR%\templspcatmr\dwco6891_1607_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_1607_x64.sys
from %WINDIR%\templspcatmr\dwco6891_1607_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_1607_x86.sys
from %WINDIR%\templspcatmr\dwco6891_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_x64.sys
from %WINDIR%\templspcatmr\dwco6891_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwco6891_x86.sys
from %WINDIR%\templspcatmr\4theyesdk6891_1607.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891_1607.dll
from %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_1607_x64.sys
from %WINDIR%\templspcatmr\dwfi6891_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_x64.sys
from %WINDIR%\templspcatmr\dwfi6891_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_x86.sys
from %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_1607_x64.sys
from %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_1607_x86.sys
from %WINDIR%\templspcatmr\dwpd6891_x64.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_x64.sys
from %WINDIR%\templspcatmr\dwpd6891_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwpd6891_x86.sys
from %WINDIR%\templspcatmr\lspadv.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspadv.exe
from %WINDIR%\templspcatmr\lspbho.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspbho.dll
from %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys to %ProgramFiles(x86)%\motex\lanscope cat mr\dwfi6891_1607_x86.sys
from %WINDIR%\templspcatmr\lsphook64.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lsphook64.dll
from %WINDIR%\templspcatmr\lspmanifest_ff.json to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmanifest_ff.json
from %WINDIR%\templspcatmr\lspmladdin2x64.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin2x64.msi
from %WINDIR%\templspcatmr\lspmladdin2x86.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin2x86.msi
from %WINDIR%\templspcatmr\lspwaogctomr.json to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaogctomr.json
from %WINDIR%\templspcatmr\lspwaoicon48.png to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoicon48.png
from %WINDIR%\templspcatmr\lspwaoicon64.png to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoicon64.png
from %WINDIR%\templspcatmr\lspwaoiconext128.png to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext128.png
from %WINDIR%\templspcatmr\lspwaoiconext16.png to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext16.png
from %WINDIR%\templspcatmr\lspwaoiconext48.png to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoiconext48.png
from %WINDIR%\templspcatmr\lspwaoie.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoie.dll
from %WINDIR%\templspcatmr\lspwaoinstall.rdf to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoinstall.rdf
from %WINDIR%\templspcatmr\lspwaomanifest.mf to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomanifest.mf
from %WINDIR%\templspcatmr\lspwaomozilla.rsa to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomozilla.rsa
from %WINDIR%\templspcatmr\lspwaomozilla.sf to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaomozilla.sf
from %WINDIR%\templspcatmr\lspweb.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspweb.dll
from %WINDIR%\templspcatmr\lspweb64.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lspweb64.dll
from %WINDIR%\templspcatmr\manifest.mf to %ProgramFiles(x86)%\motex\lanscope cat mr\manifest.mf
from %WINDIR%\templspcatmr\mozilla.rsa to %ProgramFiles(x86)%\motex\lanscope cat mr\mozilla.rsa
from %WINDIR%\templspcatmr\mozilla.sf to %ProgramFiles(x86)%\motex\lanscope cat mr\mozilla.sf
from %WINDIR%\templspcatmr\spflog.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\spflog.dll
from %WINDIR%\templspcatmr\startmr.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe
from %ProgramFiles(x86)%\motex\lanscope cat mr\cmr.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe
from %WINDIR%\templspcatmr\lspwaogctomr.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaogctomr.exe
from %WINDIR%\templspcatmr\lspwaoffgoogledrive.js to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffgoogledrive.js
from %WINDIR%\templspcatmr\lspwaofftomr.json to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaofftomr.json
from %WINDIR%\templspcatmr\lspwaoffdom.js to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffdom.js
from %WINDIR%\templspcatmr\lspmladdin4x64.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin4x64.msi
from %WINDIR%\templspcatmr\lspmladdin4x86.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmladdin4x86.msi
from %WINDIR%\templspcatmr\lspmlvaddin35x64.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin35x64.msi
from %WINDIR%\templspcatmr\lspmlvaddin35x86.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin35x86.msi
from %WINDIR%\templspcatmr\lspmlvaddin40x64.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin40x64.msi
from %WINDIR%\templspcatmr\lspmlvaddin40x86.msi to %ProgramFiles(x86)%\motex\lanscope cat mr\lspmlvaddin40x86.msi
from %WINDIR%\templspcatmr\lspoffdev.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspoffdev.exe
from %WINDIR%\templspcatmr\lspoffdevq.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspoffdevq.exe
from %WINDIR%\templspcatmr\lspquest.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspquest.exe
from %WINDIR%\templspcatmr\lsprelay.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lsprelay.exe
from %WINDIR%\templspcatmr\lspsrvany.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe
from %WINDIR%\templspcatmr\lspstop.exe to %ProgramFiles(x86)%\motex\lanscope cat mr\lspstop.exe
from %WINDIR%\templspcatmr\lsputil.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\lsputil.dll
from %WINDIR%\templspcatmr\lspwaochrome.manifest to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaochrome.manifest
from %WINDIR%\templspcatmr\lspwaoconfig.cfg to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoconfig.cfg
from %WINDIR%\templspcatmr\lspwaoff.js to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoff.js
from %WINDIR%\templspcatmr\lspwaoff.xul to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoff.xul
from %WINDIR%\templspcatmr\lspwaoffbackground.html to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffbackground.html
from %WINDIR%\templspcatmr\lspwaoffbackground.js to %ProgramFiles(x86)%\motex\lanscope cat mr\lspwaoffbackground.js
from %ProgramFiles%\motex\lansco~1\_nicinfo.txt to %ProgramFiles%\motex\lansco~1\nicinfo.txt
from %WINDIR%\templspcatmr\4theyesdk6891.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891.dll
from %TEMP%\templspcat\startmr.exe to %WINDIR%\templspcatmr\startmr.exe
from %TEMP%\templspcat\spflog.dll to %WINDIR%\templspcatmr\spflog.dll
from %TEMP%\templspcat\lspcuninst.exe to %WINDIR%\templspcatmr\lspcuninst.exe
from %TEMP%\templspcat\lspcuninst.exe.manifest to %WINDIR%\templspcatmr\lspcuninst.exe.manifest
from %TEMP%\templspcat\lspdevconf.exe to %WINDIR%\templspcatmr\lspdevconf.exe
from %TEMP%\templspcat\lspdnd.dll to %WINDIR%\templspcatmr\lspdnd.dll
from %TEMP%\templspcat\lspdnd64.dll to %WINDIR%\templspcatmr\lspdnd64.dll
from %TEMP%\templspcat\lspetwapi.dll to %WINDIR%\templspcatmr\lspetwapi.dll
from %TEMP%\templspcat\lspevmon.exe to %WINDIR%\templspcatmr\lspevmon.exe
from %TEMP%\templspcat\lspcdw.dll to %WINDIR%\templspcatmr\lspcdw.dll
from %TEMP%\templspcat\lspcfm.exe to %WINDIR%\templspcatmr\lspcfm.exe
from %TEMP%\templspcat\lspevmon64.exe to %WINDIR%\templspcatmr\lspevmon64.exe
from %TEMP%\templspcat\lspfilter_2k3.sys to %WINDIR%\templspcatmr\lspfilter_2k3.sys
from %TEMP%\templspcat\lspfilter_2k3_x64.sys to %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys
from %TEMP%\templspcat\lspfilter_vista.sys to %WINDIR%\templspcatmr\lspfilter_vista.sys
from %TEMP%\templspcat\lspfilter_vista_x64.sys to %WINDIR%\templspcatmr\lspfilter_vista_x64.sys
from %TEMP%\templspcat\lspfilter_win7.sys to %WINDIR%\templspcatmr\lspfilter_win7.sys
from %TEMP%\templspcat\lspfilter_win7_x64.sys to %WINDIR%\templspcatmr\lspfilter_win7_x64.sys
from %TEMP%\templspcat\lspfilter_xp.sys to %WINDIR%\templspcatmr\lspfilter_xp.sys
from %TEMP%\templspcat\lspffaddonxpi@motex.co.jp.xpi to %WINDIR%\templspcatmr\lspffaddonxpi@motex.co.jp.xpi
from %TEMP%\templspcat\lspfilter_2k.sys to %WINDIR%\templspcatmr\lspfilter_2k.sys
from %TEMP%\templspcat\lspbits.exe to %WINDIR%\templspcatmr\lspbits.exe
from %TEMP%\templspcat\lspbho64.dll to %WINDIR%\templspcatmr\lspbho64.dll
from %TEMP%\templspcat\lspbho.dll to %WINDIR%\templspcatmr\lspbho.dll
from %TEMP%\templspcat\4theyesdk6891_1607.dll to %WINDIR%\templspcatmr\4theyesdk6891_1607.dll
from %TEMP%\templspcat\cmr.exe to %WINDIR%\templspcatmr\cmr.exe
from %TEMP%\templspcat\cose.manifest to %WINDIR%\templspcatmr\cose.manifest
from %TEMP%\templspcat\cose.sig to %WINDIR%\templspcatmr\cose.sig
from %TEMP%\templspcat\dsofile.dll to %WINDIR%\templspcatmr\dsofile.dll
from %TEMP%\templspcat\dwco6891_1607_x64.sys to %WINDIR%\templspcatmr\dwco6891_1607_x64.sys
from %TEMP%\templspcat\dwco6891_1607_x86.sys to %WINDIR%\templspcatmr\dwco6891_1607_x86.sys
from %TEMP%\templspcat\dwco6891_x64.sys to %WINDIR%\templspcatmr\dwco6891_x64.sys
from %TEMP%\templspcat\4theyesdk6891.dll to %WINDIR%\templspcatmr\4theyesdk6891.dll
from %TEMP%\templspcat\dwco6891_x86.sys to %WINDIR%\templspcatmr\dwco6891_x86.sys
from %TEMP%\templspcat\dwfi6891_1607_x86.sys to %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys
from %TEMP%\templspcat\dwfi6891_x64.sys to %WINDIR%\templspcatmr\dwfi6891_x64.sys
from %TEMP%\templspcat\dwfi6891_x86.sys to %WINDIR%\templspcatmr\dwfi6891_x86.sys
from %TEMP%\templspcat\dwpd6891_1607_x64.sys to %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys
from %TEMP%\templspcat\dwpd6891_1607_x86.sys to %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys
from %TEMP%\templspcat\dwpd6891_x64.sys to %WINDIR%\templspcatmr\dwpd6891_x64.sys
from %TEMP%\templspcat\dwpd6891_x86.sys to %WINDIR%\templspcatmr\dwpd6891_x86.sys
from %TEMP%\templspcat\lspadv.exe to %WINDIR%\templspcatmr\lspadv.exe
from %TEMP%\templspcat\dwfi6891_1607_x64.sys to %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys
from %TEMP%\templspcat\lsphook.dll to %WINDIR%\templspcatmr\lsphook.dll
from %TEMP%\templspcat\lsphook64.dll to %WINDIR%\templspcatmr\lsphook64.dll
from %TEMP%\templspcat\lspmanifest_ff.json to %WINDIR%\templspcatmr\lspmanifest_ff.json
from %TEMP%\templspcat\lspmladdin2x64.msi to %WINDIR%\templspcatmr\lspmladdin2x64.msi
from %TEMP%\templspcat\lspwaogctomr.exe to %WINDIR%\templspcatmr\lspwaogctomr.exe
from %TEMP%\templspcat\lspwaogctomr.json to %WINDIR%\templspcatmr\lspwaogctomr.json
from %TEMP%\templspcat\lspwaoicon48.png to %WINDIR%\templspcatmr\lspwaoicon48.png
from %TEMP%\templspcat\lspwaoicon64.png to %WINDIR%\templspcatmr\lspwaoicon64.png
from %TEMP%\templspcat\lspwaoiconext128.png to %WINDIR%\templspcatmr\lspwaoiconext128.png
from %TEMP%\templspcat\lspwaoiconext16.png to %WINDIR%\templspcatmr\lspwaoiconext16.png
from %TEMP%\templspcat\lspwaoiconext48.png to %WINDIR%\templspcatmr\lspwaoiconext48.png
from %TEMP%\templspcat\lspwaoie.dll to %WINDIR%\templspcatmr\lspwaoie.dll
from %TEMP%\templspcat\lspwaoinstall.rdf to %WINDIR%\templspcatmr\lspwaoinstall.rdf
from %TEMP%\templspcat\lspwaomanifest.mf to %WINDIR%\templspcatmr\lspwaomanifest.mf
from %TEMP%\templspcat\lspwaomozilla.rsa to %WINDIR%\templspcatmr\lspwaomozilla.rsa
from %TEMP%\templspcat\lspwaomozilla.sf to %WINDIR%\templspcatmr\lspwaomozilla.sf
from %TEMP%\templspcat\lspweb.dll to %WINDIR%\templspcatmr\lspweb.dll
from %TEMP%\templspcat\lspweb64.dll to %WINDIR%\templspcatmr\lspweb64.dll
from %TEMP%\templspcat\manifest.mf to %WINDIR%\templspcatmr\manifest.mf
from %TEMP%\templspcat\mozilla.rsa to %WINDIR%\templspcatmr\mozilla.rsa
from %TEMP%\templspcat\mozilla.sf to %WINDIR%\templspcatmr\mozilla.sf
from %TEMP%\templspcat\mr.ini to %WINDIR%\templspcatmr\mr.ini
from %TEMP%\templspcat\msg to %WINDIR%\templspcatmr\msg
from %TEMP%\templspcat\lspwaofftomr.json to %WINDIR%\templspcatmr\lspwaofftomr.json
from %TEMP%\templspcat\lspwaoffdom.js to %WINDIR%\templspcatmr\lspwaoffdom.js
from %TEMP%\templspcat\lspwaoffgoogledrive.js to %WINDIR%\templspcatmr\lspwaoffgoogledrive.js
from %TEMP%\templspcat\lspwaoffbackground.js to %WINDIR%\templspcatmr\lspwaoffbackground.js
from %TEMP%\templspcat\lspmladdin2x86.msi to %WINDIR%\templspcatmr\lspmladdin2x86.msi
from %TEMP%\templspcat\lspmladdin4x64.msi to %WINDIR%\templspcatmr\lspmladdin4x64.msi
from %TEMP%\templspcat\lspmladdin4x86.msi to %WINDIR%\templspcatmr\lspmladdin4x86.msi
from %TEMP%\templspcat\lspmlvaddin35x64.msi to %WINDIR%\templspcatmr\lspmlvaddin35x64.msi
from %TEMP%\templspcat\lspmlvaddin35x86.msi to %WINDIR%\templspcatmr\lspmlvaddin35x86.msi
from %TEMP%\templspcat\lspmlvaddin40x64.msi to %WINDIR%\templspcatmr\lspmlvaddin40x64.msi
from %TEMP%\templspcat\lspmlvaddin40x86.msi to %WINDIR%\templspcatmr\lspmlvaddin40x86.msi
from %TEMP%\templspcat\lspoffdev.exe to %WINDIR%\templspcatmr\lspoffdev.exe
from %TEMP%\templspcat\lspoffdevq.exe to %WINDIR%\templspcatmr\lspoffdevq.exe
from %TEMP%\templspcat\lspquest.exe to %WINDIR%\templspcatmr\lspquest.exe
from %TEMP%\templspcat\lsprelay.exe to %WINDIR%\templspcatmr\lsprelay.exe
from %TEMP%\templspcat\lspsrvany.exe to %WINDIR%\templspcatmr\lspsrvany.exe
from %TEMP%\templspcat\lspstop.exe to %WINDIR%\templspcatmr\lspstop.exe
from %TEMP%\templspcat\lsputil.dll to %WINDIR%\templspcatmr\lsputil.dll
from %TEMP%\templspcat\lspwaochrome.manifest to %WINDIR%\templspcatmr\lspwaochrome.manifest
from %TEMP%\templspcat\lspwaoconfig.cfg to %WINDIR%\templspcatmr\lspwaoconfig.cfg
from %TEMP%\templspcat\lspwaoff.js to %WINDIR%\templspcatmr\lspwaoff.js
from %TEMP%\templspcat\lspwaoff.xul to %WINDIR%\templspcatmr\lspwaoff.xul
from %TEMP%\templspcat\lspwaoffbackground.html to %WINDIR%\templspcatmr\lspwaoffbackground.html
from %TEMP%\templspcat\setmr.exe to %WINDIR%\templspcatmr\setmr.exe
from %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891_1607.dll to %ProgramFiles(x86)%\motex\lanscope cat mr\4theyesdk6891.dll

Network activity

Connects to

'<LOCALNET>.201.47':38002

Miscellaneous

Searches for the following windows

ClassName: 'TMainForm' WindowName: 'LanScope Cat'

Creates and executes the following

'%WINDIR%\templspcatmr\setmr.exe' i smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe' smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe'
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe' smsg reboot
'%ProgramFiles(x86)%\motex\lanscope cat mr\startmr.exe' smsg reboot' (with hidden window)
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent' (with hidden window)
'%ProgramFiles(x86)%\motex\lanscope cat mr\lspcmr.exe' smsg reboot' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\LANSCO~1\_NICInfo.txt"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c arp -d' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\LANSCO~1\_NICInfo.txt"
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\cmd.exe' /c arp -d
'%WINDIR%\syswow64\arp.exe' -d

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial