Adware.InstallCore.114

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\conhost.exe'
'<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ish894322\css\ie6_main.css
%TEMP%\ish894322\css\main.css
%TEMP%\ish894322\css\sdk-ui\browse.css
%TEMP%\ICReinstall_<Имя вируса>.exe
%TEMP%\ish894322\blank.gif
%TEMP%\ish894322\css\buttons.css
%TEMP%\ish894322\css\sdk-ui\button.css
%TEMP%\ish894322\css\sdk-ui\progress-bar.css
%TEMP%\ish894322\DAT\DSiteU.dat
%TEMP%\ish894322\images\back-button.png
%TEMP%\ish894322\css\sdk-ui\checkbox.css
%TEMP%\ish894322\css\sdk-ui\images\button-bg.png
%TEMP%\ish894322\css\sdk-ui\images\progress-bg.png
%TEMP%\000DA572.log
%TEMP%\ish888956\images\progress-bg.png
%TEMP%\ish888956\images\Progress.png
%TEMP%\ish888956\images\ProgressBar.png
%TEMP%\ish888956\images\next-button-es.png
%TEMP%\ish888956\images\next-button-over.png
%TEMP%\ish888956\images\next-button.png
%TEMP%\ish888956\license\DE.license.txt
%TEMP%\ish888956\bootstrap_58683.html
%PROGRAM_FILES%\is893792.log
%TEMP%\000DA562.log
%TEMP%\ish888956\license\EN.license.txt
%TEMP%\ish888956\locale\EN.locale
%TEMP%\ish888956\sdk\exceptlist.txt
%TEMP%\ish894322\license\EN.license.txt
%TEMP%\ish894322\locale\EN.locale
%TEMP%\ish894322\sdk\exceptlist.txt
%TEMP%\ish894322\images\Progress.png
%TEMP%\ish894322\images\ProgressBar.png
%TEMP%\ish894322\license\DE.license.txt
%TEMP%\000DAA14.log
%WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
%WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_0bec5a6e\Report.wer
%TEMP%\is357113909\2061316574.cfg
%TEMP%\is357113909\337013952.cfg
%TEMP%\ish894322\images\progress-bg.png
%TEMP%\ish894322\images\Bg.gif
%TEMP%\ish894322\images\close-button.png
%TEMP%\ish894322\images\close_button.png
%TEMP%\ish894322\images\back-over.png
%TEMP%\ish894322\images\back.png
%HOMEPATH%\Desktop\Continue PDF Creator Installation.lnk
%TEMP%\ish894322\images\finish-button.png
%TEMP%\ish894322\images\next-button-es.png
%TEMP%\ish894322\images\next-button-over.png
%TEMP%\ish894322\images\next-button.png
%TEMP%\ish894322\images\icon.png
%TEMP%\ish894322\images\loader.gif
%TEMP%\ish894322\images\next-button-disabled.png
%TEMP%\ish888956\images\next-button-disabled.png
%TEMP%\ish887848\images\close_button.png
%TEMP%\ish887848\images\finish-button.png
%TEMP%\ish887848\images\icon.png
%TEMP%\ish887848\images\back.png
%TEMP%\ish887848\images\Bg.gif
%TEMP%\ish887848\images\close-button.png
%TEMP%\ish887848\images\loader.gif
%TEMP%\ish887848\images\next-button.png
%TEMP%\ish887848\images\progress-bg.png
%TEMP%\ish887848\images\Progress.png
%TEMP%\ish887848\images\next-button-disabled.png
%TEMP%\ish887848\images\next-button-es.png
%TEMP%\ish887848\images\next-button-over.png
%TEMP%\ish887848\images\back-over.png
%TEMP%\ish887848\css\ie6_main.css
%TEMP%\ish887848\css\main.css
%TEMP%\ish887848\css\sdk-ui\browse.css
%TEMP%\000D8C18.log
%TEMP%\ish887848\blank.gif
%TEMP%\ish887848\css\buttons.css
%TEMP%\ish887848\css\sdk-ui\button.css
%TEMP%\ish887848\css\sdk-ui\progress-bar.css
%TEMP%\ish887848\DAT\DSiteU.dat
%TEMP%\ish887848\images\back-button.png
%TEMP%\ish887848\css\sdk-ui\checkbox.css
%TEMP%\ish887848\css\sdk-ui\images\button-bg.png
%TEMP%\ish887848\css\sdk-ui\images\progress-bg.png
%TEMP%\ish888956\DAT\DSiteU.dat
%TEMP%\ish888956\images\back-button.png
%TEMP%\ish888956\images\back-over.png
%TEMP%\ish888956\css\sdk-ui\images\button-bg.png
%TEMP%\ish888956\css\sdk-ui\images\progress-bg.png
%TEMP%\ish888956\css\sdk-ui\progress-bar.css
%TEMP%\ish888956\images\back.png
%TEMP%\ish888956\images\finish-button.png
%TEMP%\ish888956\images\icon.png
%TEMP%\ish888956\images\loader.gif
%TEMP%\ish888956\images\Bg.gif
%TEMP%\ish888956\images\close-button.png
%TEMP%\ish888956\images\close_button.png
%TEMP%\ish888956\css\sdk-ui\checkbox.css
%TEMP%\ish887848\locale\EN.locale
%TEMP%\ish887848\sdk\exceptlist.txt
%TEMP%\000D8FB1.log
%TEMP%\ish887848\images\ProgressBar.png
%TEMP%\ish887848\license\DE.license.txt
%TEMP%\ish887848\license\EN.license.txt
%TEMP%\000D906C.log
%TEMP%\ish888956\css\main.css
%TEMP%\ish888956\css\sdk-ui\browse.css
%TEMP%\ish888956\css\sdk-ui\button.css
%TEMP%\ish888956\blank.gif
%TEMP%\ish888956\css\buttons.css
%TEMP%\ish888956\css\ie6_main.css

Удаляет следующие файлы:

%TEMP%\ish887848\images\Progress.png
%TEMP%\ish887848\images\progress-bg.png
%TEMP%\ish887848\images\ProgressBar.png
%TEMP%\ish887848\license\DE.license.txt
%TEMP%\000D906C.log
%TEMP%\ish887848\images\next-button-disabled.png
%TEMP%\ish887848\images\loader.gif
%TEMP%\ish887848\images\next-button-es.png
%TEMP%\ish887848\images\next-button.png
%TEMP%\ish887848\images\next-button-over.png
%TEMP%\000DAA14.log
%TEMP%\000DA572.log
%TEMP%\ish888956\bootstrap_58683.html
%WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
%WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
%TEMP%\ish887848\locale\EN.locale
%TEMP%\ish887848\license\EN.license.txt
%TEMP%\ish887848\sdk\exceptlist.txt
%TEMP%\000DA562.log
%PROGRAM_FILES%\is893792.log
%TEMP%\ish887848\images\icon.png
%TEMP%\ish887848\css\sdk-ui\browse.css
%TEMP%\ish887848\css\main.css
%TEMP%\ish887848\css\sdk-ui\button.css
%TEMP%\ish887848\css\sdk-ui\images\button-bg.png
%TEMP%\ish887848\css\sdk-ui\checkbox.css
%TEMP%\000D8FB1.log
%TEMP%\000D8C18.log
%TEMP%\ish887848\blank.gif
%TEMP%\ish887848\css\ie6_main.css
%TEMP%\ish887848\css\buttons.css
%TEMP%\ish887848\images\Bg.gif
%TEMP%\ish887848\images\back.png
%TEMP%\ish887848\images\close-button.png
%TEMP%\ish887848\images\finish-button.png
%TEMP%\ish887848\images\close_button.png
%TEMP%\ish887848\css\sdk-ui\progress-bar.css
%TEMP%\ish887848\css\sdk-ui\images\progress-bg.png
%TEMP%\ish887848\DAT\DSiteU.dat
%TEMP%\ish887848\images\back-over.png
%TEMP%\ish887848\images\back-button.png

Сетевая активность:

Подключается к:

'20#.#6.232.182':80
'os.####pdfcreator.com':80
'cd###.##olpdfcreator.com':80

TCP:

Запросы HTTP GET:

20#.#6.232.182/fwlink/?Li######################################################################################################
cd###.##olpdfcreator.com/app/Cmp/PDFCreatorV4.cis

Запросы HTTP POST: