Trojan.Inject3.26762

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\dllhost.exe

Modifies file system

Creates the following files

%TEMP%\photoshop_set-up.exe
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkfull2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\dropdown.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\dropdown2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\spinner.gif
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\spinner2x.gif
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkmark.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkmark2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\timer.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\timer2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\check.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\check2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\facebook2x.png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\google.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\google2x.png
%TEMP%\pdapp.log
<LS_APPDATA>\adobe\oobe\opm.db-journal
<LS_APPDATA>\adobe\oobe\opm.db
%TEMP%\creativecloud\acc\hardwareconfig.json
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\navcancl[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkfull.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\facebook.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkempty2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\ie8\angular.min.js
%TEMP%\creativecloud\acc\wam.log
<LS_APPDATA>\adobe\oobe\temp_lbs_wid
<LS_APPDATA>\adobe\oobe\temp_ins_lbs_wid
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\main.html
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\js\main.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\js\maincontroller.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\js\overlaycontroller.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\js\utils.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\jquery.min.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\ie8\jquery.min.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\angular.min.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\jquery.custom-scrollbar.min.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\erroricon2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\lib\jquery.placeholder.min.js
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\main.css
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\clean.css
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\producticon.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\producticon2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\producticon4x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\ccicon.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\ccicon2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\cancelbutton.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\cancelbutton2x.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\erroricon.png
%TEMP%\{c1d09207-b992-4d95-a776-58cfc93615e1}\images\checkempty.png
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]