Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe
-
Size
103KB
-
MD5
6ce691981dae7e7dab4b59aa8fb7a7a5
-
SHA1
8974ca68fa06d9879642cf1a9681ec185c84bb28
-
SHA256
482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4
-
SHA512
a8a62836ac4347ee133d1bc23d0259b65ac136f710123b22d0629ae3b6c359e2c96b2710fdef0c0284490ba8fd80dd67c0dc6d031ca78219812e19e2ebdb5717
-
SSDEEP
1536:vBUBRVBtPwgI1YTgSc27tnvSHWoRgQfwVz0byMnBclnUErC2ep2RvS:vB4+gIpSZvcnxnmMBclnUd27RK
Score
8/10
Malware Config
Signatures
-
Contacts a large (1964) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Registers COM server for autorun 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "C:\\Windows\\SysWow64\\gjlnvrfh\b¬e.dll" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vtezivayb¼wF.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\lieqziphb¼wn.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\fqpciohsb¼wc.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\gakvwdjrb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\pvplfapfb¼w;.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\emcntgkdb¼w..dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\wkiwgajlb¼w8.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\muolhilcb¼wk.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\xuixiaahb¼wg.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\zdopmnqdb¼w%.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\nsbtxdbob¼w6.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\xtbjpmsab¼w(.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\uaxdypnqb¼w].dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ojqodkfgb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ampjweplb¼w=.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\lrlknfpkb¼wf.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\jhkufvdrb¼wv.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\biejknenb¼wI.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\xrruefmtb¼w}.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\qsyaurerb¼w .dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\cvggpfpub¼wa.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\qszhoqvlb¼wY.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\otohydjd¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\xcnagxzx¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ikgwlcgub¼wF.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\vwmvdgnob¼[email protected] 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\wszmtbyhb¼wB.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\fxcgvsqhb¼wh.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\vcfesbgub¼wo.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\baqtdkqib¼w^.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\klwlagieb¼wY.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\sxasvnjrb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ngtedycnb¼w8.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\lwqpzspmb¼w5.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\zslkxniib¼wT.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\gqpgzbuxb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\vfkoawwlb¼wz.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\dfxtrgep¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\uzugsnbp¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\pnjrhjrk¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ffxhhxvsb¼w..dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\eovqrurdb¼w:.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ekvnpexr¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\gahkzbro¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ykmechgob¼w).dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ghmmwsksb¼wr.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\cpodwqqlb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\jfmoocxkb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\jucmlzemb¼wT.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\hvmpbcntb¼w .dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\giihzapkb¼wu.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\soexdbozb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\prgxbrrbb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ojhcjxveb¼wN.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\kgridbbtb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\zehniqhqb¼wl.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\orbwspqeb¼w~.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\mngrjebzb¼w.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\qwjkrhef¸.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\mxwlcqhrb¼wW.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\xajdqpjsb¼wV.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\ccuylimib¼w3.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\gxypzwkhb¼w?.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Windows\SysWOW64\tppyeqqtb¼wF.dll 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\README.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\Welcome.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\olsrcpmp.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\qosgcwlx.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\xaypgdde.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\lbzlwlul.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vhmdrpew.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\aifzsoze.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\cpgxktqv.exe 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\CloseUndo.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C2FD192-0F9A-CE0D-90FE-8C0FC2C098A4}\ = "rxtalowcpqxtfwft" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00601406-8BE9-717A-1083-DA67296B4787}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C2FD192-0F9A-CE0D-90FE-8C0FC2C098A4}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D12B7811-00DC-EA9D-9F6E-2CBC442DE822}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EB3E5CB-E787-C5C3-8140-DFDCB174D3B0}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EB3E5CB-E787-C5C3-8140-DFDCB174D3B0}\ = "pwoekrzchwwihast" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9D1AA66-7E27-7A37-6749-64B471FB93B0} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\\mdqoyzkq.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD8CA0E4-99C1-007A-8121-9E1D15DBA87F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\olsrcpmp.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70192085-18B9-0172-7888-C144022D1494} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "xcfwwysmqfvxlxmx" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B21393C1-140C-261D-2407-44240E921BFE}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D12B7811-00DC-EA9D-9F6E-2CBC442DE822}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\panvxkes.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D12B7811-00DC-EA9D-9F6E-2CBC442DE822}\ = "budroeqjehrezlsx" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD8CA0E4-99C1-007A-8121-9E1D15DBA87F}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC913063-F31E-CFAC-1F69-69B994953AFA}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nfznphgz.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C2FD192-0F9A-CE0D-90FE-8C0FC2C098A4} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00601406-8BE9-717A-1083-DA67296B4787}\ = "edxkxjzdlqxgkycp" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00601406-8BE9-717A-1083-DA67296B4787}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qosgcwlx.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA45811D-FBBA-52AC-0E8A-D1A2A192F282}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC913063-F31E-CFAC-1F69-69B994953AFA} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC913063-F31E-CFAC-1F69-69B994953AFA}\ = "lhpodnijzovdatma" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EB3E5CB-E787-C5C3-8140-DFDCB174D3B0}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vhmdrpew.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9D1AA66-7E27-7A37-6749-64B471FB93B0}\ = "ugjxvxskyerqqjqs" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22c6c651-f6ea-46be-bc83-54e83314c67f}\InProcServer32\ = "C:\\Windows\\SysWow64\\ydhmumka\x7fb¼w\x17.dll" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\\xaypgdde.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA45811D-FBBA-52AC-0E8A-D1A2A192F282}\ = "dfnnjxyecbiaveah" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70192085-18B9-0172-7888-C144022D1494}\ = "twexhbuhmuyvcblq" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30FE6C2E-6B60-B95B-2534-DA69161A094A}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26505C22-102D-8561-A09F-0F62468DB1DB} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "zmblovuaweacxbzs" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA45811D-FBBA-52AC-0E8A-D1A2A192F282} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA45811D-FBBA-52AC-0E8A-D1A2A192F282}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\nvgmzfxw.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26505C22-102D-8561-A09F-0F62468DB1DB}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\uonsbjsn.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70192085-18B9-0172-7888-C144022D1494}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30FE6C2E-6B60-B95B-2534-DA69161A094A} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26505C22-102D-8561-A09F-0F62468DB1DB}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C2FD192-0F9A-CE0D-90FE-8C0FC2C098A4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30FE6C2E-6B60-B95B-2534-DA69161A094A}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\mjqajsqb.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30FE6C2E-6B60-B95B-2534-DA69161A094A}\ = "hditaxzwzclftsaj" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D12B7811-00DC-EA9D-9F6E-2CBC442DE822} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD8CA0E4-99C1-007A-8121-9E1D15DBA87F}\ = "ntfjnsmufsilnmgu" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B21393C1-140C-261D-2407-44240E921BFE}\LocalServer32\ = "C:\\Program Files\\Java\\jre1.8.0_66\\cpgxktqv.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00601406-8BE9-717A-1083-DA67296B4787} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9D1AA66-7E27-7A37-6749-64B471FB93B0}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "rufakixqbmbgmybr" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC913063-F31E-CFAC-1F69-69B994953AFA}\LocalServer32 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "oosmjaknrfdxskat" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B21393C1-140C-261D-2407-44240E921BFE} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B21393C1-140C-261D-2407-44240E921BFE}\ = "ozxmomafmmvlrhec" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EB3E5CB-E787-C5C3-8140-DFDCB174D3B0} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70192085-18B9-0172-7888-C144022D1494}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\lbzlwlul.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26505C22-102D-8561-A09F-0F62468DB1DB}\ = "jhiegovxdsttqgda" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "C:\\Windows\\SysWow64\\gjlnvrfh\b¬e.dll" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9D1AA66-7E27-7A37-6749-64B471FB93B0}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\aifzsoze.exe" 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD8CA0E4-99C1-007A-8121-9E1D15DBA87F} 482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe"C:\Users\Admin\AppData\Local\Temp\482f60c3bb41802f921bfb90ded2085da1122416862454ae459bdd1ac92f3de4.exe"1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1332