Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUP' = '%WINDIR%\M_ourfol3\services.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACL' = '%WINDIR%\M_ourfol3\svchost.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateELMRACLUPPOP' = '%WINDIR%\M_ourfol3\smss.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'LepideUpdateKEY_STROKE' = '%WINDIR%\M_ourfol3\csrss.exe'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\lepidetempfol\aximage.ocx
- %TEMP%\zy_temp\2021_01_14_19_49_24_116_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_24_116_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_26_3_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_26_3_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_26_3_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_27_922_pm_0.bmp
- %TEMP%\zx_temp\2021_01_14_19_49_27_922_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_33_741_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_29_841_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_29_841_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_29_841_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_31_807_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_31_807_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_31_807_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_24_116_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_27_922_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_22_213_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_16_441_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_12_463_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_12_463_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_14_475_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_14_475_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_14_475_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_16_441_pm_0.bmp
- %TEMP%\zx_temp\2021_01_14_19_49_16_441_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_22_213_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_18_375_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_18_375_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_18_375_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_20_294_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_20_294_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_20_294_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_22_213_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_33_741_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_33_741_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_35_644_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_49_169_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_49_169_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_49_169_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_51_73_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_51_73_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_47_235_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_47_235_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_49_51_73_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_49_52_960_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_54_848_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_54_848_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_54_848_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_56_767_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_52_960_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_52_960_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_47_235_pm_0.bmp
- %TEMP%\zx_temp\2021_01_14_19_49_45_285_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_45_285_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_35_644_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_37_563_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_37_563_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_37_563_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_39_513_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_39_513_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_35_644_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_39_513_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_41_447_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_41_447_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_43_366_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_43_366_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_43_366_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_45_285_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_41_447_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_12_463_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_56_767_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_10_544_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_10_544_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_38_48_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_38_48_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_38_48_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_39_920_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_39_920_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_39_920_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_41_839_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_45_708_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_48_41_839_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_43_758_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_43_758_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_43_758_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_45_708_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_45_708_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_36_129_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_41_839_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_36_129_pm_0.jpeg
- %TEMP%\lepidetempfol\svchost.exe
- %TEMP%\lepidetempfol\csrss.exe
- %TEMP%\lepidetempfol\edlvadminopenscripts.exe
- %TEMP%\lepidetempfol\lepideprocessexecuteservice.exe
- %TEMP%\lepidetempfol\services.exe
- %TEMP%\lepidetempfol\smss.exe
- %TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe
- %WINDIR%\m_ourfol3\smss.exe
- %TEMP%\zy_temp\112.bmp
- %WINDIR%\m_ourfol3\csrss.exe
- %WINDIR%\m_ourfol3\services.exe
- %WINDIR%\m_ourfol3\svchost.exe
- %WINDIR%\m_ourfol3\edlvadminopenscripts.exe
- %WINDIR%\m_ourfol3\lepideprocessexecuteservice.exe
- %WINDIR%\m_ourfol3\aximage.ocx
- %TEMP%\zy_temp\2021_01_14_19_48_36_129_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_47_642_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_47_642_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_47_642_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_49_01_11_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_02_914_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_02_914_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_02_914_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_04_864_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_01_11_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_01_11_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_04_864_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_06_753_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_06_753_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_08_641_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_08_641_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_08_641_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_49_04_864_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_06_753_pm_0.bmp
- %TEMP%\zx_temp\2021_01_14_19_48_59_124_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_59_124_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_59_124_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_49_576_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_49_576_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_51_511_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_51_511_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_51_511_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_53_398_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_49_576_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_53_398_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_55_302_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_55_302_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_55_302_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_48_57_220_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_57_220_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_48_57_220_pm_0.bin
- %TEMP%\zx_temp\2021_01_14_19_48_53_398_pm_0.bin
- %TEMP%\zy_temp\2021_01_14_19_49_10_544_pm_0.jpeg
- %TEMP%\zx_temp\2021_01_14_19_49_56_767_pm_0.bin
Удаляет следующие файлы
- %TEMP%\zy_temp\2021_01_14_19_48_36_129_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_33_741_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_33_741_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_31_807_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_31_807_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_29_841_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_29_841_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_27_922_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_27_922_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_35_644_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_26_3_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_24_116_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_24_116_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_22_213_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_22_213_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_20_294_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_20_294_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_18_375_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_18_375_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_26_3_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_47_235_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_56_767_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_37_563_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_54_848_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_54_848_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_52_960_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_52_960_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_51_73_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_51_73_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_49_169_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_49_169_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_16_441_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_47_235_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_45_285_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_45_285_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_43_366_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_43_366_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_41_447_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_41_447_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_39_513_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_39_513_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_35_644_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_37_563_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_16_441_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_55_302_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_51_511_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_51_511_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_49_576_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_49_576_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_47_642_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_47_642_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_45_708_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_45_708_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_53_398_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_43_758_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_41_839_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_41_839_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_39_920_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_39_920_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_38_48_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_38_48_pm_0.bmp
- %TEMP%\zy_temp\112.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_36_129_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_43_758_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_04_864_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_14_475_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_55_302_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_12_463_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_12_463_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_10_544_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_10_544_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_08_641_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_08_641_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_06_753_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_06_753_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_14_475_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_04_864_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_02_914_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_02_914_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_49_01_11_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_01_11_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_59_124_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_59_124_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_57_220_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_48_57_220_pm_0.bmp
- %TEMP%\zy_temp\2021_01_14_19_48_53_398_pm_0.jpeg
- %TEMP%\zy_temp\2021_01_14_19_49_56_767_pm_0.jpeg
Подменяет следующие файлы
- %TEMP%\zy_temp\112.bmp
Сетевая активность
Подключается к
- '<LOCALNET>.100.29':1005
- '12#.#9.78.139':1005
Другое
Создает и запускает на исполнение
- '%TEMP%\lepidetempfol\standaloneinstallcopyallfromtemp.exe'
- '%WINDIR%\m_ourfol3\edlvadminopenscripts.exe'
- '%WINDIR%\m_ourfol3\services.exe'
- '%WINDIR%\m_ourfol3\svchost.exe'
- '%WINDIR%\m_ourfol3\csrss.exe'
- '%WINDIR%\m_ourfol3\smss.exe'
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\M_ourfol3\AxImage.ocx"
