Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\McciCMService] 'ImagePath' = '"%CommonProgramFiles(x86)%\Motive\McciCMService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService64] 'ImagePath' = '"%CommonProgramFiles%\Motive\McciCMService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService64] 'Start' = '00000002'
Modifies file system
Creates the following files
- %TEMP%\nsda57a.tmp
- %CommonProgramFiles%\motive\mcciutilsx.dll
- %TEMP%\mcciuacmanagerx.dll
- %CommonProgramFiles%\motive\mcciuacmanagerx.dll
- %TEMP%\axb.exe
- %TEMP%\nszcecc.tmp
- %TEMP%\nseceec.tmp\nsisplugin.dll
- %CommonProgramFiles(x86)%\motive\mccicmservice.exe
- %CommonProgramFiles(x86)%\motive\mcciutilsx.dll
- %CommonProgramFiles(x86)%\motive\mccilogx.dll
- %CommonProgramFiles(x86)%\motive\mccicontrolhost.exe
- %CommonProgramFiles(x86)%\motive\mccieventx.dll
- %CommonProgramFiles(x86)%\motive\mccihttpx.dll
- %CommonProgramFiles(x86)%\motive\mccismx.dll
- %CommonProgramFiles(x86)%\motive\mccisysx.dll
- %TEMP%\mcciutilsx.dll
- %CommonProgramFiles(x86)%\motive\installhelper.exe
- %CommonProgramFiles%\motive\mccisysx.dll
- %CommonProgramFiles%\motive\mccilogx.dll
- %TEMP%\nsya6e2.tmp\nsisplugin.dll
- %TEMP%\installhelper.exe
- %CommonProgramFiles%\motive\installhelper.exe
- %TEMP%\mccicmservice.exe
- %CommonProgramFiles%\motive\mccicmservice.exe
- %TEMP%\mccilogx.dll
- %TEMP%\mccicontrolhost.exe
- %CommonProgramFiles%\motive\mccismx.dll
- %CommonProgramFiles%\motive\mccicontrolhost.exe
- %TEMP%\mccieventx.dll
- %CommonProgramFiles%\motive\mccieventx.dll
- %TEMP%\mccihttpx.dll
- %CommonProgramFiles%\motive\mccihttpx.dll
- %TEMP%\mccismx.dll
- %TEMP%\mccisysx.dll
- %CommonProgramFiles(x86)%\motive\mcciuacmanagerx.dll
Deletes the following files
- %TEMP%\installhelper.exe
- %TEMP%\mccicmservice.exe
- %TEMP%\mccilogx.dll
- %TEMP%\mccicontrolhost.exe
- %TEMP%\mccieventx.dll
- %TEMP%\mccihttpx.dll
- %TEMP%\mccismx.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mcciutilsx.dll
- %TEMP%\mcciuacmanagerx.dll
- %TEMP%\nseceec.tmp\nsisplugin.dll
- %TEMP%\axb.exe
Substitutes the following files
- %TEMP%\installhelper.exe
- %TEMP%\mccicmservice.exe
- %TEMP%\mccilogx.dll
- %TEMP%\mccicontrolhost.exe
- %TEMP%\mccieventx.dll
- %TEMP%\mccihttpx.dll
- %TEMP%\mccismx.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mcciutilsx.dll
- %TEMP%\mcciuacmanagerx.dll
Miscellaneous
Creates and executes the following
- '%CommonProgramFiles%\motive\mccicontrolhost.exe' /RegServer
- '%TEMP%\axb.exe' /S
- '%CommonProgramFiles(x86)%\motive\mccicontrolhost.exe' /RegServer
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /predefinedallaccess /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /addlegacy= /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /registercmservice /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\mccicmservice.exe' /Service
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /startcmservice /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\mccicmservice.exe'
- '%CommonProgramFiles%\motive\installhelper.exe' /predefinedallaccess /Platform=X64
- '%CommonProgramFiles%\motive\installhelper.exe' /addlegacy= /Platform=X64
- '%CommonProgramFiles%\motive\installhelper.exe' /registercmservice /Platform=X64
- '%CommonProgramFiles%\motive\mccicmservice.exe' /Service
- '%CommonProgramFiles%\motive\installhelper.exe' /startcmservice /Platform=X64
- '%CommonProgramFiles%\motive\mccicmservice.exe'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSysX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciLogX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUACManagerX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUACManagerX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciUACManagerX.dll"
