Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUP' = '%WINDIR%\M_ourfol3\services.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUPPOP' = '%WINDIR%\M_ourfol3\smss.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateKEY_STROKE' = '%WINDIR%\M_ourfol3\csrss.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACL' = '%WINDIR%\M_ourfol3\svchost.exe'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\lepidetempfol\aximage.ocx
- %TEMP%\zy_temp\2020_02_29_16_39_10_962_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_10_962_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_08_946_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_08_946_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_08_946_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_07_25_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_07_25_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_07_25_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_05_9_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_05_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_05_9_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_02_962_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_02_962_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_39_10_962_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_02_962_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_00_931_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_00_931_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_59_9_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_59_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_59_9_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_57_9_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_57_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_57_9_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_54_930_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_54_930_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_54_930_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_52_836_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_52_836_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_39_00_931_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_22_697_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_32_463_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_39_12_916_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_32_463_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_30_494_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_30_494_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_30_494_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_28_526_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_28_526_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_28_526_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_26_588_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_26_588_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_26_588_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_24_619_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_24_619_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_24_619_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_52_836_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_22_697_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_22_697_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_20_822_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_20_822_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_20_822_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_18_854_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_18_854_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_18_854_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_16_885_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_16_885_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_16_885_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_39_14_901_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_39_14_901_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_14_901_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_12_916_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_12_916_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_38_50_867_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_31_70_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_29_180_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_27_258_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_27_258_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_27_258_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_25_305_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_25_305_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_25_305_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_23_258_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_23_258_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_23_258_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_21_242_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_21_242_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_21_242_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_29_180_pm_0.jpeg
- %TEMP%\zy_temp\112.bmp
- %WINDIR%\m_ourfol3\lepideprocessexecuteservice.exe
- %WINDIR%\m_ourfol3\edlvadminopenscripts.exe
- %WINDIR%\m_ourfol3\svchost.exe
- %WINDIR%\m_ourfol3\services.exe
- %WINDIR%\m_ourfol3\csrss.exe
- %WINDIR%\m_ourfol3\smss.exe
- %TEMP%\lepidetempfol\svchost.exe
- %TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe
- %TEMP%\lepidetempfol\smss.exe
- %TEMP%\lepidetempfol\services.exe
- %TEMP%\lepidetempfol\lepideprocessexecuteservice.exe
- %TEMP%\lepidetempfol\edlvadminopenscripts.exe
- %TEMP%\lepidetempfol\csrss.exe
- %WINDIR%\m_ourfol3\aximage.ocx
- %TEMP%\zy_temp\2020_02_29_16_38_40_945_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_50_867_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_31_70_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_38_48_805_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_48_805_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_48_805_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_46_789_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_46_789_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_46_789_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_44_852_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_44_852_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_44_852_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_42_852_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_42_852_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_42_852_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_40_945_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_50_867_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_40_945_pm_0.jpeg
- %TEMP%\zx_temp\2020_02_29_16_38_38_914_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_38_914_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_38_914_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_36_945_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_36_945_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_36_945_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_35_39_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_35_39_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_35_39_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_33_55_pm_0.bin
- %TEMP%\zy_temp\2020_02_29_16_38_33_55_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_33_55_pm_0.bmp
- %TEMP%\zx_temp\2020_02_29_16_38_31_70_pm_0.bin
- %TEMP%\zx_temp\2020_02_29_16_38_29_180_pm_0.bin
- %TEMP%\zx_temp\2020_02_29_16_39_32_463_pm_0.bin
Удаляет следующие файлы
- %TEMP%\zy_temp\2020_02_29_16_38_21_242_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_12_916_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_10_962_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_10_962_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_08_946_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_08_946_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_07_25_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_07_25_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_05_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_05_9_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_02_962_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_02_962_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_00_931_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_00_931_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_59_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_59_9_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_12_916_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_14_901_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_32_463_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_16_885_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_30_494_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_30_494_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_28_526_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_28_526_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_26_588_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_26_588_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_24_619_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_24_619_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_22_697_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_22_697_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_20_822_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_20_822_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_18_854_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_18_854_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_39_16_885_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_57_9_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_14_901_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_57_9_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_36_945_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_35_39_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_33_55_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_33_55_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_31_70_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_31_70_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_29_180_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_29_180_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_27_258_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_27_258_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_25_305_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_25_305_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_23_258_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_23_258_pm_0.bmp
- %TEMP%\zy_temp\112.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_21_242_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_35_39_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_36_945_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_54_930_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_38_914_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_52_836_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_52_836_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_50_867_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_50_867_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_48_805_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_48_805_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_46_789_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_46_789_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_44_852_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_44_852_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_42_852_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_42_852_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_40_945_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_40_945_pm_0.bmp
- %TEMP%\zy_temp\2020_02_29_16_38_38_914_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_38_54_930_pm_0.jpeg
- %TEMP%\zy_temp\2020_02_29_16_39_32_463_pm_0.jpeg
Подменяет следующие файлы
- %TEMP%\zy_temp\112.bmp
Сетевая активность
Подключается к
- '<LOCALNET>.1.188':1005
Другое
Создает и запускает на исполнение
- '%TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe'
- '%WINDIR%\m_ourfol3\edlvadminopenscripts.exe'
- '%WINDIR%\m_ourfol3\services.exe'
- '%WINDIR%\m_ourfol3\svchost.exe'
- '%WINDIR%\m_ourfol3\csrss.exe'
- '%WINDIR%\m_ourfol3\smss.exe'
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"
