Техническая информация
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\snippingtool\appcmd.xml
- %TEMP%\snippingtool\ja-jp\iisexpresstray.exe.mui
- %TEMP%\snippingtool\ja-jp\iisres.dll.mui
- %TEMP%\snippingtool\ko\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\ko\iisexpresstray.resources.dll
- %TEMP%\snippingtool\ko-kr\appcmd.exe.mui
- %TEMP%\snippingtool\ko-kr\appobj.dll.mui
- %TEMP%\snippingtool\ko-kr\iisexpresstray.exe.mui
- %TEMP%\snippingtool\ko-kr\iisres.dll.mui
- %TEMP%\snippingtool\license.rtf
- %TEMP%\snippingtool\logcust.dll
- %TEMP%\snippingtool\iisreqs.dll
- %TEMP%\snippingtool\loghttp.dll
- %TEMP%\snippingtool\microsoft.visualstudio.telemetry.dll
- %TEMP%\snippingtool\microsoft.visualstudio.utilities.internal.dll
- %TEMP%\snippingtool\microsoft.web.tasks.dll
- %TEMP%\snippingtool\modrqflt.dll
- %TEMP%\snippingtool\nativrd2.dll
- %TEMP%\snippingtool\newtonsoft.json.dll
- %TEMP%\snippingtool\notice.txt
- %TEMP%\snippingtool\pl\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\pl\iisexpresstray.resources.dll
- %TEMP%\snippingtool\pl-pl\appcmd.exe.mui
- %TEMP%\snippingtool\pl-pl\appobj.dll.mui
- %TEMP%\snippingtool\ja\iisexpresstray.resources.dll
- %TEMP%\snippingtool\microsoft.visualstudio.remotecontrol.dll
- %TEMP%\snippingtool\ja-jp\appobj.dll.mui
- %TEMP%\snippingtool\ja-jp\appcmd.exe.mui
- %TEMP%\snippingtool\ja\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\it-it\iisres.dll.mui
- %TEMP%\snippingtool\hwebcore.dll
- %TEMP%\snippingtool\iiscore.dll
- %TEMP%\snippingtool\iisexpress.exe.manifest
- %TEMP%\snippingtool\iisexpressadmincmd.exe.config
- %TEMP%\snippingtool\iisexpresshelper.dll
- %TEMP%\snippingtool\iisexpressshim.sdb
- %TEMP%\snippingtool\iisexpresstray.dll
- %TEMP%\snippingtool\iisexpresstray.exe.config
- %TEMP%\snippingtool\iisexpresstray.exe.manifest
- %TEMP%\snippingtool\iisfcgi.dll
- %TEMP%\snippingtool\pl-pl\iisexpresstray.exe.mui
- %TEMP%\snippingtool\iisfreb.dll
- %TEMP%\snippingtool\fr-fr\iisexpresstray.exe.mui
- %TEMP%\snippingtool\iisres.dll
- %TEMP%\snippingtool\iisutil2.dll
- %TEMP%\snippingtool\iisvermg.dll
- %TEMP%\snippingtool\iiswsock.dll
- %TEMP%\snippingtool\iis_ssi.dll
- %TEMP%\snippingtool\iprestr.dll
- %TEMP%\snippingtool\isapi.dll
- %TEMP%\snippingtool\it\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\it\iisexpresstray.resources.dll
- %TEMP%\snippingtool\it-it\appcmd.exe.mui
- %TEMP%\snippingtool\it-it\appobj.dll.mui
- %TEMP%\snippingtool\fr-fr\iisres.dll.mui
- %TEMP%\snippingtool\it-it\iisexpresstray.exe.mui
- %TEMP%\snippingtool\iisrtl.dll
- %TEMP%\snippingtool\gzip.dll
- %TEMP%\snippingtool\pl-pl\iisres.dll.mui
- %TEMP%\snippingtool\pt-br\appcmd.exe.mui
- %TEMP%\snippingtool\w3tp.dll
- %TEMP%\snippingtool\w3wphost.dll
- %TEMP%\snippingtool\warmup.dll
- %TEMP%\snippingtool\wbhst_pm.dll
- %TEMP%\snippingtool\wcf35setup.js
- %TEMP%\snippingtool\webdav.dll
- %TEMP%\snippingtool\webdav_simple_lock.dll
- %TEMP%\snippingtool\webdav_simple_prop.dll
- %TEMP%\snippingtool\webmatrixsup.dll
- %TEMP%\snippingtool\website1\bkg-blu.jpg
- %TEMP%\snippingtool\website1\iis.png
- %TEMP%\snippingtool\upgradeapplicationhost.js
- %TEMP%\snippingtool\website1\iisstart.htm
- %TEMP%\snippingtool\website1\w-brand.png
- %TEMP%\snippingtool\zh-cn\appcmd.exe.mui
- %TEMP%\snippingtool\zh-cn\appobj.dll.mui
- %TEMP%\snippingtool\zh-cn\iisexpresstray.exe.mui
- %TEMP%\snippingtool\zh-cn\iisres.dll.mui
- %TEMP%\snippingtool\zh-hans\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\zh-hans\iisexpresstray.resources.dll
- %TEMP%\snippingtool\zh-hant\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\zh-hant\iisexpresstray.resources.dll
- %TEMP%\snippingtool\zh-tw\appcmd.exe.mui
- %TEMP%\snippingtool\zh-tw\appobj.dll.mui
- %TEMP%\snippingtool\validcfg.dll
- %TEMP%\snippingtool\w3dt.dll
- %TEMP%\snippingtool\urlauthz.dll
- %TEMP%\snippingtool\tr-tr\iisres.dll.mui
- %TEMP%\snippingtool\custerr\en-us\404-3.htm
- %TEMP%\snippingtool\pt-br\appobj.dll.mui
- %TEMP%\snippingtool\pt-br\iisexpresstray.exe.mui
- %TEMP%\snippingtool\pt-br\iisres.dll.mui
- %TEMP%\snippingtool\redirect.dll
- %TEMP%\snippingtool\redist.txt
- %TEMP%\snippingtool\release_notes.url
- %TEMP%\snippingtool\rewrite.dll
- %TEMP%\snippingtool\rsca2.dll
- %TEMP%\snippingtool\rscaext.dll
- %TEMP%\snippingtool\rtinfo.dll
- %TEMP%\snippingtool\protsup.dll
- %TEMP%\snippingtool\pt\iisexpresstray.resources.dll
- %TEMP%\snippingtool\pt\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\ru\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\ru-ru\iisexpresstray.exe.mui
- %TEMP%\snippingtool\ru-ru\iisres.dll.mui
- %TEMP%\snippingtool\snippingtool.exe
- %TEMP%\snippingtool\static.dll
- %TEMP%\snippingtool\system.runtime.compilerservices.unsafe.dll
- %TEMP%\snippingtool\tr\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\tr\iisexpresstray.resources.dll
- %TEMP%\snippingtool\tr-tr\appcmd.exe.mui
- %TEMP%\snippingtool\tr-tr\appobj.dll.mui
- %TEMP%\snippingtool\tr-tr\iisexpresstray.exe.mui
- %TEMP%\snippingtool\ru\iisexpresstray.resources.dll
- %TEMP%\snippingtool\ru-ru\appcmd.exe.mui
- %TEMP%\snippingtool\ru-ru\appobj.dll.mui
- %TEMP%\snippingtool\fr-fr\appobj.dll.mui
- %TEMP%\snippingtool\fr-fr\appcmd.exe.mui
- %TEMP%\snippingtool\fr\iisexpresstray.resources.dll
- %TEMP%\snippingtool\cs\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\cs\iisexpresstray.resources.dll
- %TEMP%\snippingtool\cs-cz\appcmd.exe.mui
- %TEMP%\snippingtool\cs-cz\appobj.dll.mui
- %TEMP%\snippingtool\cs-cz\iisexpresstray.exe.mui
- %TEMP%\snippingtool\cs-cz\iisres.dll.mui
- %TEMP%\snippingtool\custerr\en-us\401-1.htm
- %TEMP%\snippingtool\custerr\en-us\401-2.htm
- %TEMP%\snippingtool\custerr\en-us\401-3.htm
- %TEMP%\snippingtool\custerr\en-us\401-4.htm
- %TEMP%\snippingtool\custerr\en-us\401-5.htm
- %TEMP%\snippingtool\custerr\en-us\403-3.htm
- %TEMP%\snippingtool\custerr\en-us\401.htm
- %TEMP%\snippingtool\custerr\en-us\403-10.htm
- %TEMP%\snippingtool\custerr\en-us\403-11.htm
- %TEMP%\snippingtool\custerr\en-us\403-12.htm
- %TEMP%\snippingtool\custerr\en-us\403-13.htm
- %TEMP%\snippingtool\custerr\en-us\403-14.htm
- %TEMP%\snippingtool\custerr\en-us\403-15.htm
- %TEMP%\snippingtool\custerr\en-us\403-16.htm
- %TEMP%\snippingtool\custerr\en-us\403-17.htm
- %TEMP%\snippingtool\custerr\en-us\403-18.htm
- %TEMP%\snippingtool\custerr\en-us\403-19.htm
- %TEMP%\snippingtool\config\templates\personalwebserver\applicationhost.config
- %TEMP%\snippingtool\config\schema\webdav_schema.xml
- %TEMP%\snippingtool\config\templates\personalwebserver\redirection.config
- %TEMP%\snippingtool\config\schema\rscaext.xml
- %TEMP%\snippingtool\config\schema\rewrite_schema.xml
- %TEMP%\snippingtool\appobj.dll
- %TEMP%\snippingtool\asp.dll
- %TEMP%\snippingtool\asp.net core module\v2\17.0.22116\aspnetcorev2_outofprocess.dll
- %TEMP%\snippingtool\asp.net core module\v2\aspnetcorev2.dll
- %TEMP%\snippingtool\aspnetcore.dll
- %TEMP%\snippingtool\asptlb.tlb
- %TEMP%\snippingtool\authanon.dll
- %TEMP%\snippingtool\authbas.dll
- %TEMP%\snippingtool\authcert.dll
- %TEMP%\snippingtool\authmap.dll
- %TEMP%\snippingtool\authsspi.dll
- %TEMP%\snippingtool\custerr\en-us\403-2.htm
- %TEMP%\snippingtool\browscap.dll
- %TEMP%\snippingtool\custerr\en-us\403-1.htm
- %TEMP%\snippingtool\cachtokn.dll
- %TEMP%\snippingtool\cgi.dll
- %TEMP%\snippingtool\compdyn.dll
- %TEMP%\snippingtool\compstat.dll
- %TEMP%\snippingtool\config\administration.config
- %TEMP%\snippingtool\config\schema\aspnetcore_schema.xml
- %TEMP%\snippingtool\config\schema\aspnetcore_schema_v2.xml
- %TEMP%\snippingtool\config\schema\aspnet_schema.xml
- %TEMP%\snippingtool\config\schema\dbmanager_schema.xml
- %TEMP%\snippingtool\config\schema\fx_schema.xml
- %TEMP%\snippingtool\config\schema\iis_schema.xml
- %TEMP%\snippingtool\browscap.ini
- %TEMP%\snippingtool\appserver\applicationhost.config
- %TEMP%\snippingtool\cachuri.dll
- %TEMP%\snippingtool\config\templates\personalwebserver\aspnet.config
- %TEMP%\snippingtool\custerr\en-us\403-4.htm
- %TEMP%\snippingtool\custerr\en-us\500-19.htm
- %TEMP%\snippingtool\custerr\en-us\501.htm
- %TEMP%\snippingtool\custerr.dll
- %TEMP%\snippingtool\de\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\de\iisexpresstray.resources.dll
- %TEMP%\snippingtool\de-de\appcmd.exe.mui
- %TEMP%\snippingtool\de-de\appobj.dll.mui
- %TEMP%\snippingtool\de-de\iisexpresstray.exe.mui
- %TEMP%\snippingtool\de-de\iisres.dll.mui
- %TEMP%\snippingtool\defdoc.dll
- %TEMP%\snippingtool\diprestr.dll
- %TEMP%\snippingtool\custerr\en-us\500-18.htm
- %TEMP%\snippingtool\custerr\en-us\403-5.htm
- %TEMP%\snippingtool\custerr\en-us\500.htm
- %TEMP%\snippingtool\dirlist.dll
- %TEMP%\snippingtool\en-us\iisexpresstray.exe.mui
- %TEMP%\snippingtool\en-us\iisres.dll.mui
- %TEMP%\snippingtool\es\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\es\iisexpresstray.resources.dll
- %TEMP%\snippingtool\es-es\appcmd.exe.mui
- %TEMP%\snippingtool\es-es\appobj.dll.mui
- %TEMP%\snippingtool\es-es\iisexpresstray.exe.mui
- %TEMP%\snippingtool\es-es\iisres.dll.mui
- %TEMP%\snippingtool\filter.dll
- %TEMP%\snippingtool\fr\iisexpressadmincmd.resources.dll
- %TEMP%\snippingtool\en-us\appcmd.exe.mui
- %TEMP%\snippingtool\en-us\appobj.dll.mui
- %TEMP%\snippingtool\en-us\iisexpress.exe.mui
- %TEMP%\snippingtool\website1\msweb-brand.png
- %TEMP%\snippingtool\zh-tw\iisexpresstray.exe.mui
- %TEMP%\snippingtool\custerr\en-us\500-15.htm
- %TEMP%\snippingtool\custerr\en-us\403-7.htm
- %TEMP%\snippingtool\custerr\en-us\403-8.htm
- %TEMP%\snippingtool\custerr\en-us\403-9.htm
- %TEMP%\snippingtool\custerr\en-us\403.htm
- %TEMP%\snippingtool\custerr\en-us\404-1.htm
- %TEMP%\snippingtool\custerr\en-us\404-10.htm
- %TEMP%\snippingtool\custerr\en-us\404-11.htm
- %TEMP%\snippingtool\custerr\en-us\404-12.htm
- %TEMP%\snippingtool\custerr\en-us\404-13.htm
- %TEMP%\snippingtool\custerr\en-us\404-14.htm
- %TEMP%\snippingtool\custerr\en-us\404-15.htm
- %TEMP%\snippingtool\custerr\en-us\500-16.htm
- %TEMP%\snippingtool\custerr\en-us\500-17.htm
- %TEMP%\snippingtool\custerr\en-us\404-2.htm
- %TEMP%\snippingtool\custerr\en-us\404-5.htm
- %TEMP%\snippingtool\custerr\en-us\404-6.htm
- %TEMP%\snippingtool\custerr\en-us\404-7.htm
- %TEMP%\snippingtool\custerr\en-us\404-8.htm
- %TEMP%\snippingtool\custerr\en-us\404-9.htm
- %TEMP%\snippingtool\custerr\en-us\404.htm
- %TEMP%\snippingtool\custerr\en-us\405.htm
- %TEMP%\snippingtool\custerr\en-us\406.htm
- %TEMP%\snippingtool\custerr\en-us\412.htm
- %TEMP%\snippingtool\custerr\en-us\500-13.htm
- %TEMP%\snippingtool\custerr\en-us\500-14.htm
- %TEMP%\snippingtool\custerr\en-us\403-6.htm
- %TEMP%\snippingtool\custerr\en-us\404-4.htm
- %TEMP%\snippingtool\zh-tw\iisres.dll.mui
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\snippingtool\snippingtool.exe'
Запускает на исполнение
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
